This vulnerability exists in the Oracle WebCenter Content component of Oracle Fusion Middleware. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful exploitation can lead to unauthorized access to critical data or full access to all accessible data within Oracle WebCenter Content, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 7.1, reflecting high confidentiality impact and low integrity impact, with no availability impact. The vulnerability also has scope change implications, potentially affecting additional Oracle products. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle’s August 2026 Critical Security Patch Update includes fixes for this vulnerability.

Exploitation of this vulnerability can result in unauthorized access to sensitive and critical data within Oracle WebCenter Content and unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system. The vulnerability does not impact availability. The scope change indicates that other Oracle products relying on Oracle WebCenter Content may also be affected indirectly.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to remediate this issue. Staying on actively-supported versions and applying Oracle patches without delay is recommended. No additional mitigation steps are specified beyond applying the official patch.