This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It permits unauthenticated attackers to exploit the system over HTTP to compromise data integrity and confidentiality by unauthorized creation, deletion, or modification of critical data or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory linked does not explicitly confirm patch availability or remediation status for this specific vulnerability, but it is part of the July 2026 Critical Patch Update advisory which includes numerous patches across Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle WebCenter Content. This results in a complete compromise of confidentiality and integrity of the data managed by the affected product versions. There is no reported impact on availability. No known exploits in the wild have been reported at the time of this advisory.

The vendor advisory for the July 2026 Critical Patch Update does not explicitly confirm the availability of a patch for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle recommends applying security patches promptly on actively supported versions to mitigate exploitation risks. Until a patch is confirmed, monitor vendor communications for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.