This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP, allowing compromise and potential takeover of the product. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The attack scope may extend to additional Oracle products. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability among 245 others. The vendor strongly recommends applying these patches without delay. Mitigations include blocking network protocols required by the attack or removing unnecessary privileges, but these may disrupt application functionality.

Successful exploitation can lead to complete compromise and takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The vulnerability also has potential to impact additional Oracle products due to scope change. The CVSS score of 9.9 reflects critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

Oracle has released a Critical Security Patch Update that includes patches for this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.