This vulnerability exists in the Oracle WebCenter Content component of Oracle Fusion Middleware. It is exploitable remotely over HTTP by an attacker with low privileges, but requires user interaction from a third party. The vulnerability can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 7.6, indicating a high severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. The scope is changed, meaning the impact extends beyond the initial vulnerable component. The vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability.

Successful exploitation can result in unauthorized access to critical data within Oracle WebCenter Content and unauthorized modification (update, insert, delete) of some accessible data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability also has a scope change, potentially impacting additional Oracle products beyond WebCenter Content.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed, organizations should limit network exposure of Oracle WebCenter Content and monitor for suspicious activity requiring user interaction.