This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the system completely. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. The vendor strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt normal operations.

Successful exploitation of this vulnerability allows an unauthenticated attacker to take over Oracle WebCenter Content, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized data access, modification, and service disruption.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly advises staying on actively supported versions and applying security patches without delay.