This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality and integrity, enabling unauthorized creation, deletion, or modification of critical data accessible through Oracle WebCenter Content. The scope of impact may extend to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, with a base score of 8.7. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability and strongly urges customers to apply patches promptly. Until patches are applied, risk can be partially mitigated by blocking required network protocols and restricting privileges, though these may affect functionality.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, leading to significant confidentiality and integrity breaches. The vulnerability also has a scope change, potentially impacting additional Oracle products beyond WebCenter Content. There is no reported availability impact. The vulnerability requires user interaction, which limits automated exploitation but still poses a high risk due to the level of access gained upon successful attack.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users without those needs. These mitigations may impact application functionality and should be tested accordingly. Oracle’s advisory does not indicate that the vulnerability is already mitigated or that no action is required.