This vulnerability exists in the Oracle WebCenter Content component of Oracle Fusion Middleware (Content Server) and affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with network access over HTTP to compromise Oracle WebCenter Content, potentially resulting in full system takeover. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, meaning successful exploitation may impact additional Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory includes patches addressing this vulnerability among 245 others. No explicit patch links were provided in the input, but Oracle strongly recommends applying the CSPU without delay.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, including full takeover of the system. This affects confidentiality, integrity, and availability of the affected product. Due to scope change, other Oracle products integrated or dependent on WebCenter Content may also be impacted. The vulnerability requires a high privileged attacker with network access via HTTP, and no user interaction is needed.

Oracle has released a Critical Security Patch Update (CSPU) in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the CSPU patches as soon as possible to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and by removing unnecessary privileges from users to limit access to vulnerable components. These mitigations may impact application functionality and should be tested accordingly. Patch status is not explicitly stated in the advisory excerpt, but the CSPU is the official fix mechanism.