This vulnerability affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an attacker with low privileges and network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (8.8 score). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. The vendor strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, but these may disrupt normal operations.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these measures may impact application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.