CVE-2026-91504 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to potentially take over the affected system. The vulnerability is difficult to exploit but can lead to full compromise of confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which contains numerous security patches across multiple products.
CVE-2026-91261 is a low-severity vulnerability in Oracle WebCenter Content 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability is difficult to exploit and does not impact integrity or availability.
CVE-2026-91210 is a vulnerability in Oracle WebCenter Content 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a third party and can lead to unauthorized access and modification of critical content data. The vulnerability impacts confidentiality and integrity but not availability.
CVE-2026-87399 is a vulnerability in Oracle WebCenter Content version 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to some data. The CVSS 3.1 base score is 6.3, indicating a medium severity with confidentiality and integrity impacts.
CVE-2026-87390 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires user interaction from a person other than the attacker. The vulnerability can also cause a partial denial of service. The CVSS 3.1 base score is 5.4, indicating medium severity with impacts on integrity and availability.
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low privileged attacker with logon access to the infrastructure to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with significant confidentiality impact but no integrity or availability impact.
CVE-2026-87371 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running Oracle WebCenter Content to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle WebCenter Content. The vulnerability is rated with a CVSS 3.1 base score of 6.8, indicating a medium severity level.
CVE-2026-87370 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to potentially compromise the system. Exploitation requires user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact and low integrity impact.
CVE-2026-87361 is a vulnerability in Oracle WebCenter Content 12.2.1.4.0 that allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible content data. The vulnerability impacts data integrity but does not affect confidentiality or availability. It has a CVSS 3.1 base score of 4.3, indicating medium severity.
CVE-2026-87360 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical data. Exploitation is difficult and requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality but does not affect integrity or availability.
CVE-2026-87299 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a third party. Successful exploitation can lead to unauthorized read, insert, update, or delete access to some accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts.
CVE-2026-87298 is a vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no impact on integrity or availability. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-70858 is a high-severity vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Successful exploitation requires human interaction from a user other than the attacker and may impact additional Oracle products beyond WebCenter Content. The vulnerability can also lead to unauthorized read access to some data and partial denial of service conditions.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).