This vulnerability affects Oracle WebCenter Content (Oracle Fusion Middleware component Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from someone other than the attacker. The scope of impact extends beyond Oracle WebCenter Content to other Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data, compromising confidentiality and integrity. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction needed, scope change, and high confidentiality and integrity impact without availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Content. Confidentiality and integrity of data are highly impacted, but availability is not affected. This could result in significant data compromise and operational disruption in affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) should be consulted for patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. No specific temporary mitigations or workarounds are provided in the advisory.