This vulnerability affects Oracle WebCenter Content 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality and integrity, enabling unauthorized creation, deletion, or modification of critical data. The scope of impact extends beyond Oracle WebCenter Content to other Oracle products. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, reflecting network attack vector, low complexity, no privileges required, user interaction required, scope changed, high confidentiality and integrity impact, and no availability impact. Oracle has published a Critical Security Patch Update advisory for June 2026 addressing this and other vulnerabilities but has not explicitly confirmed patch availability for this specific CVE in the advisory content provided.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, severely compromising confidentiality and integrity of data. The vulnerability's scope change means it may also impact additional Oracle products beyond WebCenter Content. There is no direct impact on availability. The critical CVSS score of 9.3 reflects the high potential impact on confidentiality and integrity.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. These mitigations may affect application functionality. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.