This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation requires user interaction from a third party and can result in complete takeover of the Oracle WebCenter Content product, with potential impact on additional Oracle products (scope change). The vulnerability is rated critical with a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle product families. The vendor strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack or restricting user privileges, though these may disrupt normal operations.

Successful exploitation can lead to complete compromise of Oracle WebCenter Content 14.1.2.0.0, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond WebCenter Content. The attack requires network access via HTTP and user interaction from a third party. The critical CVSS score of 9.6 reflects the high severity and potential for significant operational impact.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users. However, these mitigations may affect application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.