This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware. It is exploitable by an unauthenticated attacker who has logon access to the infrastructure where the product runs. The flaw allows unauthorized access to critical or all data accessible through Oracle WebCenter Content. The vulnerability has a CVSS 3.1 score of 7.1 with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact. The vulnerability may also affect other Oracle products due to scope change. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0.

An attacker with local logon access to the infrastructure hosting Oracle WebCenter Content can exploit this vulnerability to gain unauthorized access to critical or all data accessible by Oracle WebCenter Content. This compromises confidentiality but does not impact integrity or availability. The vulnerability's scope change means other Oracle products may also be impacted indirectly.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes remaining on actively supported versions and applying patches without delay to prevent exploitation. No indication exists that the vulnerability is already mitigated or requires no action. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. Since this is not a cloud service, remediation depends on customer patching.