This vulnerability exists in the Content Server component of Oracle WebCenter Content within Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise and potential takeover of Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact across confidentiality, integrity, and availability. The scope of impact extends beyond WebCenter Content to other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability and strongly urges customers to apply patches promptly to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, including unauthorized access and control, affecting confidentiality, integrity, and availability. The vulnerability's scope change means that other Oracle products integrated or dependent on WebCenter Content may also be impacted. This represents a critical risk to affected environments if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update that includes fixes for this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these mitigations may disrupt application functionality. No official fix status is explicitly stated in the advisory excerpt, but the presence of a Critical Security Patch Update implies that patches are available. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.