This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows an unauthenticated remote attacker to compromise the system via HTTP, requiring user interaction from a third party. The attack can result in unauthorized creation, deletion, or modification of critical data, impacting confidentiality and integrity with no impact on availability. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity. Oracle’s advisory emphasizes the importance of applying the June 2026 Critical Security Patch Update to address this and other vulnerabilities. No explicit patch link or fixed version is provided in the input data, but Oracle strongly recommends applying the CSPU promptly. Mitigation may include blocking network protocols required by the attack and restricting privileges, though these may affect functionality.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in a complete compromise of confidentiality and integrity of accessible data. The vulnerability may also affect additional Oracle products due to scope change. There is no reported impact on availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or access to certain packages from users. These mitigations may impact application functionality. No official fix version is explicitly stated in the provided data; therefore, check Oracle’s advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.