This vulnerability affects Oracle WebCenter Content, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access over HTTP to compromise the system, but successful exploitation requires user interaction from a third party. The vulnerability can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Oracle's advisory references a Critical Security Patch Update released in August 2026 addressing this and many other vulnerabilities, recommending patch application.

Successful exploitation can result in complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The attacker requires network access and low privileges but needs user interaction from another person to succeed. This could lead to takeover of the affected product.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly. No specific workaround or temporary fix is indicated. Staying on actively supported versions and applying Oracle's security patches without delay is the recommended mitigation.