This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It is exploitable remotely over HTTP without authentication but requires user interaction. The vulnerability can result in complete compromise of the affected system. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0. Oracle has published a Critical Patch Update advisory for July 2026 addressing multiple vulnerabilities, including this one, but the specific patch availability for these versions is not explicitly confirmed in the advisory content provided.

Successful exploitation can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker can remotely exploit this vulnerability via HTTP, but requires a user other than the attacker to interact with the attack vector. This can result in unauthorized access and control over the affected Oracle WebCenter Content installation.

Oracle has released a Critical Patch Update in July 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the latest security patches promptly and remain on actively supported versions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content; therefore, users should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.