This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a third party. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity with no impact on availability. The vulnerability has a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Oracle's June 2026 Critical Security Patch Update advisory addresses this and many other vulnerabilities across Oracle products. While no explicit patch version is listed for Oracle WebCenter Content 14.1.2.0.0 in the advisory, Oracle strongly recommends applying the Critical Security Patch Update promptly. Mitigations include blocking network protocols required for the attack and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in a complete compromise of confidentiality and integrity of accessible data. The vulnerability also has a scope change, potentially impacting additional Oracle products. There is no impact on availability. The attack requires human interaction from a user other than the attacker, and network access via HTTP is necessary.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users who do not require them. These mitigations may disrupt application functionality. Customers should refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.