This vulnerability affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 and allows unauthenticated remote attackers to compromise the system via HTTP. The vulnerability is easily exploitable and can lead to full takeover of the product, impacting confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update addresses this and other vulnerabilities across multiple products. The advisory emphasizes the importance of applying patches without delay to mitigate the risk. No detailed technical exploitation methods are disclosed in the advisory. Workarounds include blocking network protocols required for the attack and restricting privileges, though these may impact functionality.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product entirely. The CVSS score of 9.8 reflects critical severity with network attack vector, no required privileges or user interaction, and full impact on security properties.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to vulnerable components from users. These mitigations may affect application functionality. Patch status is not explicitly detailed in the advisory, so customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.