This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system. Exploitation requires human interaction from a third party and is considered difficult. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity with no impact on availability. The scope of impact may extend beyond Oracle WebCenter Content to other Oracle products. The vulnerability is tracked as CVE-2026-46787 with a CVSS 3.1 score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N). Oracle has included this issue in its June 2026 Critical Security Patch Update advisory but has not explicitly confirmed patch availability or remediation status for this specific vulnerability. Oracle advises customers to apply the Critical Security Patch Update promptly to address this and other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in high confidentiality and integrity impacts. The vulnerability may also affect additional Oracle products due to scope change. There is no impact on availability. Exploitation requires network access via HTTP and human interaction from a user other than the attacker. The difficulty of exploitation is high due to these conditions.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update and strongly recommends applying the update as soon as possible. The vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability, so patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges or package access from users, though these measures may impact application functionality.