This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system. Exploitation requires user interaction from a third party and is considered difficult. The impact includes unauthorized creation, deletion, or modification of critical data, with a scope change that may affect other Oracle products. The CVSS 3.1 base score is 8.0, reflecting high confidentiality and integrity impacts but no availability impact. Oracle has released a Critical Security Patch Update in June 2026 addressing this and many other vulnerabilities, strongly recommending customers apply patches promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, potentially extending to other Oracle products due to scope change. Confidentiality and integrity of data are highly impacted, while availability is not affected. The vulnerability allows unauthenticated network access via HTTP but requires human interaction from a user other than the attacker, making exploitation more complex.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches for this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by restricting privileges or access to vulnerable packages for users who do not need them. Oracle advises customers to remain on actively supported versions and apply security patches without delay. Patch status is confirmed by the vendor advisory indicating that patches are available in the June 2026 update.