This vulnerability affects Oracle WebCenter Content, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an attacker with low privileges and network access over HTTP to compromise the system. Successful exploitation requires user interaction from a third party. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with multiple CWEs including open redirect (CWE-601), cross-site scripting (CWE-79), cross-site request forgery (CWE-352), authentication issues (CWE-640), and improper input validation (CWE-20). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not provide a specific patch link or remediation level, indicating patch status is not yet confirmed.

Successful exploitation can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The attacker requires network access and low privileges but needs user interaction from another person to execute the attack. This can result in unauthorized access, data compromise, and disruption of service.

Oracle's advisory does not currently confirm the availability of a patch or official fix for this vulnerability. Customers are strongly advised to monitor Oracle's Critical Patch Update advisories and apply security patches promptly once available. Until a patch is released, organizations should consider restricting network access to Oracle WebCenter Content interfaces and educate users about the risks of interacting with untrusted content to mitigate the requirement for user interaction in exploitation.