This vulnerability affects Oracle WebCenter Content: Imaging (component: Core) in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by a low privileged attacker but requires human interaction from a user other than the attacker. The vulnerability allows unauthorized creation, deletion, or modification of critical data within WebCenter Content: Imaging, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts without availability impact. The Oracle Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability or remediation status for WebCenter Content: Imaging. Oracle strongly urges customers to apply available patches promptly to mitigate risks.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within WebCenter Content: Imaging. The vulnerability affects confidentiality and integrity with high impact, potentially allowing attackers to compromise critical data accessible through the product. The scope change indicates that other Oracle products integrated or dependent on WebCenter Content: Imaging may also be impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.