This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, but requires human interaction from a user other than the attacker. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, potentially impacting other Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high confidentiality and integrity impacts. The vendor advisory (Oracle Critical Patch Update July 2026) lists this vulnerability among many patched issues but does not explicitly confirm patch availability for this specific CVE in the provided excerpt.

Successful exploitation allows an unauthenticated attacker to gain unauthorized creation, deletion, or modification access to critical data in Oracle WebCenter Content. The vulnerability affects confidentiality and integrity of data, potentially leading to significant data compromise. There is no direct impact on availability. The scope of impact may extend beyond Oracle WebCenter Content to other Oracle products.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle WebCenter Content and monitor for suspicious activity requiring user interaction.