CVE-2026-91495 is a critical (CVSS 9.8) vulnerability in the Content Server component of Oracle WebCenter Content that lets an unauthenticated attacker with network access over HTTP take over the product.
What Is It
CVE-2026-91495 affects Oracle WebCenter Content, part of Oracle Fusion Middleware, in the Content Server component. Oracle reported it, and NVD published the record on 2026-10-20. Its NVD status is "Received."
Oracle calls the flaw "easily exploitable." An attacker needs only network access over HTTP to compromise Oracle WebCenter Content. No login and no user interaction are required.
Why It Matters
Oracle scores the flaw CVSS 3.1 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High on confidentiality, integrity and availability
A successful attack can result in takeover of Oracle WebCenter Content. The exploitability subscore is 3.9 and the impact subscore is 5.9. Taken together, this means an attacker who can reach the service over HTTP can compromise it remotely without credentials.
There is no CISA Known Exploited Vulnerabilities (KEV) entry for this CVE in the supplied data. KEV does not currently confirm active exploitation, and no CISA-required action or due date applies.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle WebCenter Content (Oracle Fusion Middleware)
- Component: Content Server
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.0.0
The NVD record has no CPE data yet.
Patch Status
The NVD record cites Oracle's October 2026 Critical Patch Update advisory as its reference. Organizations running the affected WebCenter Content versions should read that advisory and apply Oracle's remediation. Because the flaw needs no authentication, Content Server instances that can be reached over the network should be patched first.