This vulnerability exists in the Core component of Oracle Fusion Middleware's WebCenter Content: Imaging product. It permits an attacker with low privileges and network access via T3 or IIOP protocols to compromise the system. Successful exploitation can result in complete takeover of the WebCenter Content: Imaging environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for the affected versions.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Content: Imaging, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data manipulation, and service disruption within the affected product versions.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or remediation for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Customers are strongly advised to monitor Oracle's official security alerts and apply any released patches promptly once available. Until then, verify with Oracle support for the latest remediation guidance. No vendor advisory states that no action is required or that the vulnerability is already mitigated.