This vulnerability affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access over HTTP to compromise the system fully, leading to potential takeover of the product. The CVSS 3.1 score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security fixes. The advisory emphasizes the importance of applying patches promptly to prevent exploitation. No direct patch version or remediation level is explicitly stated in the advisory content provided, but Oracle's standard guidance is to apply the Critical Security Patch Update without delay. Workarounds such as blocking network protocols or restricting privileges may reduce risk temporarily but could disrupt functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can take over the product, potentially gaining full control over its operations and data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. The vendor advisory does not specify a direct patch version but includes this fix within the update. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, though these measures may impact application functionality. Customers should follow Oracle's official patching guidance as detailed in the advisory at https://www.oracle.com/security-alerts/cspujun2026.html.