CVE-2026-87365 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle WebCenter Content instances, particularly those with internet exposure, should assess their exposure and apply patches or updates to prevent exploitation.

Why it matters

CVE-2026-87365 is a medium-severity vulnerability in Oracle WebCenter Content that allows low-privileged attackers to cause a denial of service (DOS). Defenders responsible for Oracle WebCenter Content instances should assess their exposure and apply patches or updates to prevent exploitation.

• Potential denial of service (DOS) leading to application unavailability.
• Low-privileged attackers can exploit the vulnerability with network access via HTTP.
• Requires verification of exposure and application of patches or updates.

Technical summary

The vulnerability is in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server) and affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows low-privileged attackers with network access via HTTP to compromise Oracle WebCenter Content, leading to unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. The vulnerability has a CVSS score of 6.5 and a vector of (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Defenders should prioritize verifying exposure and applying patches, as the vulnerability can be exploited by low-privileged attackers with network access via HTTP.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, as the vulnerability has a medium CVSS score and can be exploited by low-privileged attackers.

Recommended defensive actions

• Verify exposure of Oracle WebCenter Content instances to the internet and restrict access if necessary.
• Apply patches or updates provided by Oracle to fix the vulnerability.
• Monitor Oracle WebCenter Content instances for signs of exploitation or anomalies.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. Oracle's security alert page also provides information on the vulnerability. The vulnerability has a medium CVSS score of 6.5 and can be exploited by low-privileged attackers with network access via HTTP. The CVE record was published on 2026-10-20T22:20:14.487Z and has not been modified since then. The NVD entry and Oracle's security alert page offer additional context and guidance on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.