This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It allows an unauthenticated attacker with infrastructure logon access to compromise Oracle WebCenter Content, resulting in unauthorized access to sensitive data. The CVSS 3.1 base score is 7.1, reflecting a high impact on confidentiality with no impact on integrity or availability. The vulnerability also has a scope change, potentially affecting other Oracle products relying on WebCenter Content. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches and strongly urges customers to apply patches promptly.

Exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle WebCenter Content. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability requires the attacker to have logon access to the underlying infrastructure but does not require authentication to Oracle WebCenter Content itself. The scope of impact may extend to additional Oracle products that depend on WebCenter Content.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Since the vendor advisory does not indicate that the vulnerability is already mitigated or requires no action, patching is the recommended remediation. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions.