Oracle WebCenter Content CVE-2026-87400

Exploitation requires (1) network/HTTP reachability to an Oracle WebCenter Content 14.1.2.0.0 Content Server instance, (2) human interaction from a victim other than the attacker - per the description and UI:R - such as opening a crafted link or performing an induced action, and (3) satisfaction of high-complexity preconditions (AC:H), indicating a race condition, specific non-default state, or precise timing rather than a single deterministic request. No valid credentials are needed (PR:N, unauthenticated). The practical limiting factors are the mandatory user interaction and the high attack complexity, which together substantially reduce the likelihood of reliable, widespread exploitation even though the vector is network-based. The scope change (S:C) means a successful attack may reach beyond WebCenter Content into connected products, so defenders should also consider trust relationships and downstream integrations.

This is a moderate-priority issue whose real-world risk is constrained by its exploitation mechanics despite a non-trivial 6.9 CVSS score. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N) shows a network-reachable, unauthenticated vector but with HIGH attack complexity and REQUIRED user interaction - meaning an attacker cannot simply fire a remote exploit; they must win a race or satisfy special conditions AND trick a legitimate user into an action. Oracle itself characterizes it as 'difficult to exploit.' The scope change (S:C) and note that attacks 'may significantly impact additional products' raise the ceiling of potential damage, and impact is weighted toward confidentiality (C:H) with limited integrity (I:L) and no availability impact (A:N). No EPSS score, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H + UI:R materially lowers practical exploitability, so this reads as a genuine-but-not-urgent flaw rather than a drop-everything emergency - prioritize it within normal Oracle CPU patching cadence unless telemetry shows targeting. Note a conflict in the input metadata: the 'Authentication Bypass' tag does not match the described behavior (an unauthenticated, user-interaction-dependent information-disclosure flaw with scope change), so that tag should be treated with skepticism and verified against the Oracle advisory.

An attacker crafts a malicious link or request targeting an internet-reachable Oracle WebCenter Content 14.1.2.0.0 server and lures a legitimate user (e.g., a content author or administrator) into interacting with it. Because the flaw has high attack complexity, the attacker must also satisfy specific timing or configuration conditions; on success, they gain read access to critical WebCenter Content data and limited write access, with potential spillover into other connected products due to the scope change. No public exploit code was identified at time of analysis.