This vulnerability affects Oracle WebCenter Content within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, but requires human interaction from a third party. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is associated with multiple CWEs including CWE-601 (Open Redirect), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Improper Input Validation). The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue.

If exploited, this vulnerability can result in complete takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The attacker does not require authentication but does need network access and relies on social engineering to induce a user to interact with malicious content. This can lead to unauthorized access, data compromise, and disruption of service.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, organizations should be cautious of social engineering attempts that could trigger exploitation of this vulnerability.