This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP but requires human interaction from a third party. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability involves weaknesses related to CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Improper Input Validation). Oracle has published a Critical Patch Update advisory for July 2026 but does not explicitly confirm a patch or remediation level for this specific vulnerability in the provided advisory content.

Successful exploitation can result in complete takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The attack requires network access and user interaction from a person other than the attacker. This could allow attackers to execute unauthorized actions and compromise sensitive content managed by the product.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, organizations should consider restricting network access to Oracle WebCenter Content and educate users to be cautious of unexpected interactions that could trigger exploitation.