This vulnerability affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access via HTTP to compromise the system, contingent on user interaction by someone other than the attacker. The attack scope includes unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content and potentially other Oracle products. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) highlights network attack vector, low attack complexity, low privileges required, user interaction needed, scope change, and high confidentiality and integrity impacts. No official patch or remediation level is explicitly stated in the vendor advisory, but the vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous security patches. Users are strongly advised to consult the vendor advisory for patch availability and apply updates promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data in Oracle WebCenter Content, severely impacting data confidentiality and integrity. The vulnerability also has a scope change, meaning it can affect additional Oracle products beyond WebCenter Content. Availability is not impacted. The CVSS score of 8.7 reflects a high severity threat.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While no explicit patch or remediation level is stated in the provided data, Oracle strongly recommends applying the latest security patches without delay. Users should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Maintaining actively-supported versions and timely patching is critical to mitigate this vulnerability.