This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker over HTTP, requiring user interaction from a third party. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. The scope is changed, meaning the impact extends beyond the vulnerable component. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible Oracle WebCenter Content data. It also allows unauthorized update, insert, or delete access to some data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability scope change means additional Oracle products may be impacted beyond WebCenter Content.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.