This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a third party and can result in unauthorized creation, deletion, or modification of critical data, with a scope change potentially impacting other Oracle products. The CVSS 3.1 base score is 8.7, reflecting high confidentiality and integrity impacts. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 security patches, strongly recommending customers apply patches promptly to mitigate risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in high confidentiality and integrity impact. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Content. There is no impact on availability reported. Exploitation requires user interaction from a person other than the attacker and network access via HTTP.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory text provided; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.