This vulnerability exists in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. It allows an unauthenticated attacker with network access over HTTP to compromise Oracle WebCenter Content, potentially leading to full system takeover. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). While difficult to exploit, successful exploitation could have significant impact, including affecting other Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others and strongly recommends applying patches promptly. No explicit patch availability or remediation level is stated for this specific CVE in the advisory, but the general guidance is to apply the Critical Security Patch Update without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, though these may impact functionality.

Successful exploitation can lead to complete takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The vulnerability also has scope change implications, meaning it may affect additional Oracle products beyond WebCenter Content. The CVSS score of 9.0 reflects critical severity with high impact on core security properties. No known exploits in the wild have been reported yet.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or access to certain packages from users who do not need them. These mitigations may affect application functionality and should be tested carefully. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; customers should consult the vendor advisory for current patch availability and installation instructions.