CVE-2026-91495PATCHED

oracle · oracle webcenter content

CVE-2026-91495: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte

Description

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products

Vendor	Product	Versions
oracle	oracle webcenter content	12.2.1.4.0, 14.1.2.0.0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
oracle	fusion middleware	cert_advisory	90%

References

https://www.oracle.com/security-alerts/cpuoct2026.html(vendor-advisory)

Related News (2 articles)

Tier B

BSI Advisories9h ago

[NEU] [hoch] Oracle Fusion Middleware: Mehrere Schwachstellen

→ No new info (linked only)

Tier C

VulDB16h ago

CVE-2026-91495 | Oracle WebCenter Content 12.2.1.4.0/14.1.2.0.0 Content Server privileges management

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://www.oracle.com/security-alerts/cpuoct2026.html

PublishedOct 20, 2026

Last enriched15h agov2

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-91323

CVE-2026-91323: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

Trending: 59

CRITICALCVE-2026-87302

CVE-2026-87302: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

Trending: 58

CRITICALCVE-2026-83399

CVE-2026-83399: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

Trending: 58

CRITICALCVE-2026-91305

CVE-2026-91305: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su

Trending: 56

CRITICALCVE-2026-91624

CVE-2026-91624: Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr

Trending: 56

Pin to Dashboard

Verification

State: verified

Confidence: 100%

Vulnerability Timeline

CVE Published

Oct 20, 2026

Discovered by ZDM

Oct 20, 2026

Updated: cweIds, tags

Oct 21, 2026

Patch Available

Oct 21, 2026

Version History

Last enriched 15h ago

v2Tier C15h ago

Added CWE-269 (Improper Access Control) and tags identifying this as an improper privilege management vulnerability affecting the Content Server component.

cweIdstags

via VulDB

v122h ago

Initial creation