This vulnerability affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable remotely without authentication but requires user interaction from a third party. Exploitation can result in unauthorized access to critical data or complete access to all accessible data within Oracle WebCenter Content, as well as unauthorized modification capabilities (update, insert, delete) on some data. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Security Patch Update advisory including this vulnerability and strongly recommends applying patches promptly. However, the specific patch availability for this vulnerability is not explicitly stated in the advisory content provided.

An attacker with network access via HTTP can exploit this vulnerability without authentication but requires a user other than themselves to interact (e.g., social engineering). Successful exploitation can lead to unauthorized access to sensitive or critical data within Oracle WebCenter Content and unauthorized ability to update, insert, or delete some of this data. This compromises confidentiality and integrity of the affected system's data.

Oracle has released a Critical Security Patch Update (CSPU) that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant security patches from Oracle's August 2026 CSPU without delay. Since the advisory does not explicitly confirm patch availability for this specific vulnerability, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patching instructions and confirm the patch status. Maintaining actively supported versions and timely patch application is critical to mitigate this risk.