This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle WebCenter Content. The vulnerability has a CVSS 3.1 score of 8.2 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references the July 2026 Critical Patch Update which includes many patches. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, as well as unauthorized access to all data accessible through the product. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond Oracle WebCenter Content to potentially affect additional Oracle products.

The vendor advisory references the Oracle Critical Patch Update for July 2026, which contains numerous security patches. However, it does not explicitly state the patch status for this specific vulnerability. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply all relevant patches promptly. Since the product is not a cloud service, remediation depends on applying vendor patches. Patch status is not yet confirmed explicitly for this vulnerability—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.