This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access over HTTPS to compromise the system, potentially leading to full takeover. The CVSS 3.1 base score is 8.1, indicating high severity with high impact on confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not specifically confirm a patch or remediation level for this CVE. The vendor strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can result in complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote network access via HTTPS, which increases the risk of takeover. However, the vulnerability is described as difficult to exploit. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle WebCenter Content instances where possible to reduce exposure.