This vulnerability in Oracle WebCenter Content (component: Content Server) affects versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP, enabling compromise of the product and potential full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly urges customers to apply these patches without delay to mitigate the risk. Until patches are applied, risk may be reduced by blocking required network protocols or removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows a low privileged attacker with network access via HTTP to fully compromise Oracle WebCenter Content, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system. The CVSS score of 8.8 reflects a high-severity impact with potential for significant damage to the affected environment.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply this patch promptly to remediate the issue. Until the patch is applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.