This vulnerability exists in the Oracle WebCenter Content component of Oracle Fusion Middleware, specifically in versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.7, indicating high severity, with confidentiality and integrity impacts but no availability impact. The vulnerability is difficult to exploit and has a scope change that may affect other Oracle products. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation level for these versions. The advisory emphasizes the importance of applying security patches promptly but does not provide a direct fix reference for this CVE in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, compromising confidentiality and integrity of data accessible through the product. There is no impact on availability. The vulnerability may also affect additional Oracle products due to scope change. The attack requires network access via HTTP but no authentication or user interaction. The difficulty of exploitation is high, reducing the likelihood of widespread exploitation without targeted effort.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or provide a specific fix for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Customers are strongly advised to review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant security patches promptly. Until a patch is confirmed, organizations should consider restricting network access to Oracle WebCenter Content HTTP interfaces to trusted sources and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.