This vulnerability affects Oracle WebCenter Content in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable by a low-privileged attacker over the network via HTTP, but requires user interaction from a third party. The CVSS 3.1 base score is 8.0, indicating high severity with high impact on confidentiality, integrity, and availability. The vulnerability involves weaknesses related to CWE-601 (URL Redirection), CWE-79 (Cross-site Scripting), CWE-352 (Cross-Site Request Forgery), and CWE-640 (Weak Password Recovery Mechanism). Oracle has published a Critical Patch Update advisory for July 2026 that includes multiple patches, but no specific patch or fix for this CVE is explicitly stated in the advisory content provided. The vendor strongly recommends applying security patches promptly to mitigate exploitation risks.

Successful exploitation allows an attacker with low privileges and network access to compromise Oracle WebCenter Content, potentially leading to full takeover of the system. The vulnerability affects confidentiality, integrity, and availability of the affected product. Exploitation requires user interaction from a person other than the attacker, which is a prerequisite for attack success.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Until a specific patch is confirmed, organizations should follow Oracle's security advisories and best practices for mitigating vulnerabilities requiring user interaction.