CVE-2026-87360 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle WebCenter Content systems, particularly those with network access and human interaction, should assess exposure and prioritize remediation based on business impact and data sensitivity.

Why it matters

Defenders should care about CVE-2026-87360 because it allows unauthorized access to critical data in Oracle WebCenter Content systems, requiring verification of exposure and prioritization of remediation.

• Potential unauthorized access to critical data
• Possible complete access to all Oracle WebCenter Content accessible data
• Need for verification of system versions and exposure
• Prioritization of remediation based on business impact and data sensitivity

Technical summary

The vulnerability in Oracle WebCenter Content allows an unauthenticated attacker with network access via HTTP to compromise the system, requiring human interaction for successful attacks. This can lead to unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. The supported versions affected are 12.2.1.4.0 and 14.1.2.0.0. Defenders should prioritize verifying exposure and assessing the need for remediation, focusing on systems with network access and human interaction. The CVSS 3.1 Base Score is 5.3 (Confidentiality impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for remediation, focusing on systems with network access and human interaction.

Recommended defensive actions

• Verify exposure by checking system versions and network access
• Assess the need for remediation based on business impact and data sensitivity
• Implement compensating controls, such as monitoring and access restrictions, if immediate remediation is not feasible
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, the corpus does not establish exploitation or specific remediation steps. Defenders should verify exposure by checking system versions and network access. The vulnerability affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0, and allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and can  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.