This vulnerability affects Oracle WebCenter Content in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit this flaw, but exploitation requires human interaction from a third party. The vulnerability can lead to complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported as of the advisory date. The vendor strongly recommends applying security patches promptly, but no specific patch for this vulnerability is explicitly confirmed in the advisory.

Successful exploitation can result in full takeover of Oracle WebCenter Content, compromising confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated network attackers to leverage user interaction to achieve system compromise.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific patch or temporary fix is explicitly stated for this vulnerability in the advisory.