This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit and requires the attacker to have access to the physical communication segment attached to the hardware where the product executes. The vulnerability allows an unauthenticated attacker to compromise Oracle WebCenter Content, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a scope change, meaning it may impact additional Oracle products beyond WebCenter Content. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating attack via adjacent network with high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and strongly recommends applying patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, compromising confidentiality and integrity of data. The vulnerability's scope change indicates potential impact on additional Oracle products beyond WebCenter Content. There is no impact on availability. The attack requires physical network segment access and is difficult to exploit, limiting the attack surface.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the available patches promptly and remain on actively supported versions. No specific temporary mitigations are indicated. Patch status is confirmed by the vendor advisory. Users should refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.