This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access to exploit the system via HTTP, potentially compromising critical data by unauthorized creation, deletion, or modification. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts, with no impact on availability. The attack complexity is high, requiring no privileges or user interaction. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Content. Oracle has included this fix in its August 2026 Critical Security Patch Update (CSPU), which contains numerous security patches across Oracle products. Customers are strongly advised to apply the relevant patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle WebCenter Content, resulting in a high impact on confidentiality and integrity of the affected system. There is no reported impact on availability. The vulnerability does not require authentication but is difficult to exploit due to high attack complexity.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond patching.