This vulnerability exists in the Oracle WebCenter Content product of Oracle Fusion Middleware (Content Server component). It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle WebCenter Content, including unauthorized modification capabilities. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability may also impact additional products due to scope change. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory linked is the July 2026 Critical Patch Update, which includes many patches but does not explicitly confirm a patch for this vulnerability at this time.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through Oracle WebCenter Content. It also allows unauthorized update, insertion, or deletion of some accessible data. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope change indicates that additional Oracle products may be impacted indirectly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly and staying on actively supported versions. Since no explicit patch or remediation level is stated for this vulnerability, organizations should monitor Oracle's advisory closely and apply patches as soon as they become available. Until patched, limit network access to Oracle WebCenter Content and apply any recommended workarounds from Oracle advisories.