This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system. The attack requires human interaction from a user other than the attacker and can result in unauthorized creation, deletion, or modification of critical data, significantly impacting confidentiality and integrity. The vulnerability is identified as CWE-352 and has a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others across multiple products. The advisory emphasizes the importance of applying patches promptly to mitigate risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in a complete compromise of confidentiality and integrity of accessible data. The vulnerability affects the security scope beyond Oracle WebCenter Content, potentially impacting additional Oracle products. There is no reported availability impact. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and by removing unnecessary privileges or access to vulnerable packages from users who do not need them, though these measures may affect application functionality. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions. Patch status for this specific vulnerability is not explicitly stated; therefore, users must verify current remediation guidance from Oracle.