This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to sensitive or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact without integrity or availability impact. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which contains numerous security fixes across many products, including Oracle WebCenter Content.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Content, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability is exploitable remotely without authentication, making it a significant risk if unpatched.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security updates without delay. No alternative mitigations or workarounds are specified in the advisory.