This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and is classified under CWE-352 (Cross-Site Request Forgery). It allows an unauthenticated attacker with network access via HTTP to compromise the system, requiring user interaction from a third party. The vulnerability can lead to complete takeover of Oracle WebCenter Content and may affect other Oracle products due to scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update addresses numerous vulnerabilities across multiple products, including Oracle WebCenter Content, but no explicit patch link or remediation level is provided for this specific CVE in the advisory. Oracle urges customers to apply the Critical Security Patch Update without delay to reduce risk.

Successful exploitation can result in full compromise of Oracle WebCenter Content 14.1.2.0.0, including takeover of the system. The vulnerability impacts confidentiality, integrity, and availability at a high level. Due to scope change, additional Oracle products may also be significantly impacted. The attack requires network access via HTTP and user interaction from a third party, but no authentication or privileges are needed by the attacker. This elevates the risk of widespread impact if exploited.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update and strongly recommends applying these patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to vulnerable packages from users who do not need them. These mitigations may impact application functionality. Patch status for this specific CVE is not explicitly confirmed in the advisory; therefore, customers should monitor Oracle's advisory for updates and apply the June 2026 Critical Security Patch Update promptly.