This vulnerability affects Oracle WebCenter Content, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely by unauthenticated attackers over HTTP but is considered difficult to exploit. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content and may impact other Oracle products due to scope change. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle WebCenter Content. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Content. The confidentiality and integrity impacts are high, but availability is not affected. No known exploits in the wild have been reported.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends staying on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.