This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP but requires human interaction from a user other than the attacker. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, causing a confidentiality and integrity impact with a CVSS 3.1 score of 8.7. The scope of impact extends beyond Oracle WebCenter Content to additional Oracle products. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple Oracle product families.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Content, resulting in a significant confidentiality and integrity breach. The vulnerability affects the security scope beyond Oracle WebCenter Content, potentially impacting other Oracle products. The CVSS score of 8.7 indicates a high impact on confidentiality and integrity, with no impact on availability. Successful exploitation requires user interaction but can be performed by an attacker with low privileges and network access.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond applying the official patch.