This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and allows a low privileged attacker with logon access to the infrastructure where the product runs to compromise it. The compromise can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle WebCenter Content. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts without availability impact. The vulnerability is tracked as CWE-284 (Improper Access Control).

Exploitation of this vulnerability can lead to unauthorized access and modification of critical data within Oracle WebCenter Content, potentially affecting the confidentiality and integrity of all accessible data. The scope change indicates that other Oracle products integrated or dependent on WebCenter Content may also be impacted by successful attacks.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. The vendor advisory emphasizes the importance of remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated.