CVE WatchOct 21, 2026

CVE-2026-87400

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that

CVSS

6.9

Medium

EPSS

0.2%

p13

KEV

—

Exploit Today

0-100

Published: Oct 20, 2026 · Last modified: Oct 21, 2026 · CWE-284

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-212026-10-26

Technical description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).

Official references

www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2026.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-118337—

—

———Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-118318—

—

———Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)2h CVE-2026-829864.6 MED

—

———The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.8h CVE-2026-829844.3 MED

—

———When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.8h CVE-2026-771734.3 MED

—

———A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.8h CVE-2026-771713.5 LOW

—

———A public shared collective always allowed recipients of the link to create pages.8h