This vulnerability affects Oracle WebCenter Content in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to compromise the system, contingent on human interaction by a third party. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Improper Input Validation). The vendor advisory from Oracle references a Critical Patch Update released in July 2026 that addresses multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE. Patch availability is not explicitly stated in the advisory content provided.

Successful exploitation can lead to complete takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The attacker does not need authentication but requires network access and a user to interact with the attack vector. This could result in unauthorized access, data compromise, and service disruption.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle WebCenter Content and educate users to be cautious of unsolicited interactions that could trigger exploitation.