This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is classified under CWE-306 (Missing Authentication for Critical Function) and allows an unauthenticated attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in complete confidentiality, integrity, and availability loss. The vendor advisory references the July 2026 Critical Patch Update, which addresses numerous vulnerabilities across Oracle products, but does not explicitly confirm a patch for this specific vulnerability in the provided text.

Successful exploitation of this vulnerability can lead to complete takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. This means attackers can potentially access sensitive data, modify or delete content, and disrupt service availability.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Organizations should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, no specific alternative mitigations are provided by Oracle. It is recommended to monitor Oracle advisories closely and apply patches promptly once available.