This vulnerability affects Oracle WebCenter Content in versions 12.2.1.4.0 and 14.1.2.0.0 and allows a low privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others across multiple products. The vendor strongly recommends applying these patches without delay. Mitigations include blocking network protocols required for exploitation and removing unnecessary privileges from users, though these may disrupt normal operations. The vendor advisory does not explicitly state the patch availability status for these specific versions but implies that patches are included in the June 2026 update.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed for these versions in the advisory, so customers should consult the official Oracle advisory for detailed patch availability and installation instructions.