This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to read a subset of accessible data without authorization. The CVSS 3.1 base score is 5.3, reflecting a confidentiality impact with no integrity or availability impact. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch for this exact version. Oracle strongly recommends applying the Critical Security Patch Update to address this and other vulnerabilities.

Successful exploitation results in unauthorized read access to some data within Oracle WebCenter Content 14.1.2.0.0. There is no impact on data integrity or system availability. The vulnerability requires only network access via HTTP and no authentication, making it relatively easy to exploit. However, the impact is limited to confidentiality of a subset of accessible data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes security patches addressing this vulnerability among others. Until patches are applied, risk may be reduced by blocking network protocols required by the attack, though this may affect application functionality. Removing unnecessary privileges or access to certain packages from users may also reduce risk. Patch status for this specific version is not explicitly confirmed; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.