This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker over the network via HTTP, allowing compromise of the product with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). The vulnerability is identified as CWE-284 (Improper Access Control). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly confirm patch availability or remediation level for these specific versions. Oracle recommends applying patches without delay and suggests mitigating risk by blocking required network protocols and removing unnecessary privileges from users until patches are applied.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (e.g., HTTP) and removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory content provided; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.