This vulnerability affects Oracle WebCenter Content, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 8.7 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality and integrity impact without availability impact. The vulnerability may also affect other Oracle products due to scope change.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system. The vulnerability does not impact availability. The scope of impact may extend to additional Oracle products beyond WebCenter Content.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. Patch status is confirmed available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.