This vulnerability affects Oracle WebCenter Content, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable by an unauthenticated attacker over the network via HTTP, though it is described as difficult to exploit. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, with a scope change potentially impacting additional Oracle products. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts without availability impact. Oracle has published this vulnerability as part of their August 2026 Critical Security Patch Update.

The vulnerability allows unauthorized attackers to gain creation, deletion, or modification access to critical data within Oracle WebCenter Content, potentially compromising confidentiality and integrity of data. The scope change indicates that additional Oracle products may also be impacted by attacks exploiting this vulnerability. The CVSS score of 8.7 reflects a high impact on confidentiality and integrity, but no impact on availability.

Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches from this update promptly to mitigate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No specific workaround or temporary fix is indicated; applying the official patch is the recommended mitigation.