This vulnerability affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access over HTTP to compromise the system, potentially resulting in full takeover of the product. The CVSS 3.1 score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches across multiple products. Oracle strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or restricting privileges may reduce risk temporarily but could disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. This means an attacker could gain unauthorized access, modify or delete data, and disrupt service availability.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory. No indication of alternative official mitigations or that no action is required.