This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP without authentication but requires user interaction from someone other than the attacker. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high impact on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of Oracle WebCenter Content and may impact other Oracle products due to scope change. The vulnerability is associated with CWE-601 (URL Redirection), CWE-352 (Cross-Site Request Forgery), and CWE-20 (Input Validation). No specific patch or remediation level is confirmed in the advisory, but Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability.

Successful exploitation can result in complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The vulnerability requires network access and user interaction, making exploitation more complex. The scope of impact extends beyond WebCenter Content to other Oracle products, increasing potential damage.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No vendor advisory states that no action is required or that the vulnerability is already mitigated.