This vulnerability affects Oracle WebCenter Content (Oracle Fusion Middleware) in versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access over HTTPS to compromise the system, contingent on user interaction from someone other than the attacker. The vulnerability can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 score of 7.6 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm patch availability for this specific CVE but strongly recommends applying the June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle products including Oracle WebCenter Content. The advisory emphasizes the importance of applying patches promptly to mitigate exploitation risks.

Successful exploitation can result in unauthorized access to critical data within Oracle WebCenter Content and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Content. This compromises confidentiality and integrity of data but does not impact availability. The attack requires user interaction from a person other than the attacker and low privileges with network access via HTTPS.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required by an attack and removing unnecessary privileges or package access from users. These mitigations may impact application functionality and should be tested accordingly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.