This vulnerability affects Oracle WebCenter Content (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTPS by an attacker with low privileges, requiring user interaction from someone other than the attacker. Successful exploitation can result in unauthorized access to critical data and limited unauthorized modification (insert, update, delete) of accessible data. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity, with confidentiality impact rated high and integrity impact rated low. The vulnerability also has a scope change, potentially impacting other Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability and recommends immediate patching. Until patches are applied, risk mitigation may include blocking required network protocols or restricting privileges, though these may affect functionality.

Successful exploitation can lead to unauthorized access to critical data within Oracle WebCenter Content and unauthorized modification of some data. The vulnerability affects confidentiality and integrity but not availability. The scope of impact extends beyond Oracle WebCenter Content to other Oracle products. This could result in significant data compromise and unauthorized data manipulation.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply these security patches as soon as possible. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to certain packages from users who do not require them. However, these mitigations may disrupt application functionality. Oracle recommends remaining on actively supported versions and promptly applying all security patches.