This vulnerability affects Oracle WebCenter Content component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access over HTTP to gain unauthorized creation, deletion, or modification capabilities on critical data or full access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector with low complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle’s June 2026 Critical Security Patch Update addresses this vulnerability among 245 others. The vendor strongly recommends applying the patches immediately to prevent exploitation. Workarounds include blocking network protocols required by the attack or restricting privileges, though these may disrupt normal operations.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle WebCenter Content. This compromises confidentiality and integrity of the affected system. There is no direct impact on availability reported. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread compromise if unpatched.

Oracle has released security patches addressing this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle strongly recommends remaining on actively supported versions and applying security updates promptly.