Oracle WebCenter Content: Authentication bypass in Content Server allows takeover

Summary

Oracle WebCenter Content Content Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CWE-287, CWE-306) that allows unauthenticated attackers with network access via HTTP to compromise the application. According to the CVE record, a successful attack can result in takeover of Oracle WebCenter Content, with high impact on confidentiality, integrity and availability. No user interaction or privileges are required. Oracle's advisory and the NVD record are the authoritative sources for technical details, which are not yet public.

Affected

• Oracle WebCenter Content, component Content Server, version 12.2.1.4.0
• Oracle WebCenter Content, component Content Server, version 14.1.2.0.0
• Earlier versions: Unknown.

Fixed in

• Patches are part of the Oracle Critical Patch Update of October 2026 (advisory published 20 October 2026).
• Specific patch numbers for 12.2.1.4.0 and 14.1.2.0.0: Unknown. Check the Oracle advisory or My Oracle Support.

Workaround

• Unknown. No vendor-published workaround was found.
• Until patched, restrict access to Content Server to internal networks or VPN and limit reachable HTTP endpoints at a reverse proxy or WAF (our own recommendation, not a vendor statement).

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalogue.
• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No public proof of concept found.
• Technical details are not public. Unconfirmed third-party summaries mention arbitrary code execution.

Our recommendation

• Identify all Content Server instances and check whether they are reachable from the internet.
• Prioritise patching of internet-facing instances; patch internal instances as well.
• Apply the October 2026 Oracle CPU after confirming the patch numbers in the advisory.
• Until patched, restrict network access and monitor HTTP access logs for unusual requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Oracle Critical Patch Update Advisory – October 2026 www.oracle.com
• NVD / CVE record via Vulners vulners.com
• VulDB CVE-2026-91495 vuldb.com
• OpenCVE CVE-2026-91495 app.opencve.io
• Oracle Critical Patch Update Advisory – September 2026 www.oracle.com
• Waratek: Oracle October 2026 Critical Patch Update waratek.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:10.