This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data and partial denial of service. The vulnerability scope extends beyond Oracle WebCenter Content to potentially affect additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L, reflecting network attack vector, low complexity, no privileges required, user interaction required, scope change, and high confidentiality and integrity impact with low availability impact. Oracle's August 2026 Critical Security Patch Update includes patches for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, unauthorized access to all accessible data, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 9.6. The scope of impact may extend to other Oracle products beyond WebCenter Content.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. It is strongly recommended to apply these patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Content. Customers should remain on actively supported versions and apply security patches without delay to mitigate this vulnerability.