This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. No specific patch or remediation level is provided in the vendor advisory, but the vulnerability is included in Oracle's July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. Oracle strongly recommends applying security patches promptly to mitigate such vulnerabilities.

Successful exploitation can lead to complete takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. This means attackers could gain unauthorized access, modify or delete content, and disrupt service availability. The vulnerability requires network access via HTTP but no authentication, increasing the risk if the system is exposed to untrusted networks.

Oracle has included this vulnerability in its July 2026 Critical Patch Update. Although no explicit patch link or remediation level is provided in the advisory, Oracle recommends that customers apply the latest security patches without delay. Staying on actively supported versions and promptly applying Oracle Critical Patch Updates is the primary mitigation. Patch status is not explicitly confirmed in the advisory text; therefore, check the Oracle July 2026 Critical Patch Update advisory for current patch availability and installation instructions.