CVE-2026-87298 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle WebCenter Content deployments should assess exposure and prioritize remediation. This vulnerability may impact confidentiality, and defenders should verify affected versions and apply patches accordingly.

Why it matters

CVE-2026-87298 is a medium-severity vulnerability in Oracle WebCenter Content that allows low-privileged attackers to potentially access critical data. Defenders should assess exposure, prioritize remediation, and verify affected versions.

• Potential unauthorized access to critical data
• Possible complete access to all Oracle WebCenter Content accessible data
• Need to verify affected versions and apply patches

Technical summary

The vulnerability in Oracle WebCenter Content, tracked as CVE-2026-87298, is an easily exploitable issue that allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. The CVSS 3.1 Base Score is 6.5, indicating a medium severity. The vulnerability affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. Defenders should assess exposure and prioritize remediation to prevent potential data breaches.

Defensive priority

Medium

Recommended defensive actions

• Review and apply Oracle's security patches for Oracle WebCenter Content
• Restrict network access to Oracle WebCenter Content to only necessary personnel
• Monitor Oracle WebCenter Content for suspicious activity
• Conduct a thorough review of affected product deployments in managed environments
• Verify affected versions and apply patches accordingly
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle WebCenter Content. Oracle's security alert page also provides information on this vulnerability. The vulnerability has a CVSS 3.1 Base Score of 6.5, indicating a medium severity. Defenders should verify affected versions and apply patches accordingly. The CVE record was published on 2026-10-20T22:20:06.850Z and has not been modified since then. No additional information is available on the vulnerability's exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.