This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to compromise the system, contingent on human interaction from a user other than the attacker. Exploitation can result in unauthorized access to critical or all accessible data, unauthorized update, insert, or delete operations on some data, and partial denial of service conditions. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. The vulnerability is associated with CWE-601 (URL Redirection) and CWE-284 (Improper Access Control). No official patch or remediation level is specified in the advisory, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle WebCenter Content, unauthorized modification (update, insert, delete) of some data, and partial denial of service. The confidentiality impact is high, while integrity and availability impacts are low. The vulnerability requires user interaction from a person other than the attacker but does not require authentication or privileges.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory. Monitor Oracle's updates for patch releases addressing this vulnerability.