This vulnerability affects Oracle WebCenter Content component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a high privileged attacker with network access over HTTP. Exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized read access to a subset of data, and partial denial of service. The vulnerability also has scope change implications, potentially affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L with a base score of 8.2. Oracle has published a Critical Security Patch Update advisory recommending patch application but no direct patch links for this specific CVE were provided in the input data.

The vulnerability allows attackers with high privileges and network access to compromise Oracle WebCenter Content, leading to unauthorized data manipulation (creation, deletion, modification), unauthorized partial data disclosure, and partial denial of service. The scope of impact may extend to additional Oracle products beyond WebCenter Content. The CVSS score of 8.2 reflects high impact on integrity and availability, and moderate impact on confidentiality.

Oracle strongly recommends applying the security patches included in the August 2026 Critical Security Patch Update as soon as possible. Customers should remain on actively supported versions and promptly apply Oracle patches to mitigate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, users should consult the Oracle Critical Security Patch Update documentation for patch availability and installation instructions.