This vulnerability affects Oracle WebCenter Content component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality and integrity impact without availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, as well as unauthorized access to all accessible data in the product. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. No indication of alternative mitigations or that the vulnerability is already mitigated without patching is provided.