This vulnerability affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable by a high privileged attacker with network access via HTTP and can result in complete compromise of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly recommends applying these patches immediately. Workarounds include blocking required network protocols and removing unnecessary privileges from users, but these may disrupt application functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product instance.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory indicating patches are available in the June 2026 update.