This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP, allowing compromise and potential takeover of the product. The vulnerability also impacts additional Oracle products due to scope change. The CVSS 3.1 score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others, urging customers to apply patches promptly. The advisory does not specify fixed versions but strongly recommends applying the update to mitigate the risk. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may impact functionality.

Successful exploitation can lead to complete compromise and takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products may also be significantly impacted. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, making it highly critical.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users who do not require them, though these measures may disrupt normal application functionality. Patch status is not explicitly confirmed in the advisory, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.