This vulnerability affects Oracle WebCenter Content in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP without authentication but requires user interaction. The vulnerability permits unauthorized modification (update, insert, delete) and partial read access to content data, as well as partial denial of service. The CVSS 3.1 base score is 7.1, reflecting low confidentiality, integrity, and availability impacts with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability has scope change, meaning it may affect other Oracle products integrated with WebCenter Content. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes many patches across Oracle products.

An attacker can remotely exploit this vulnerability without authentication but requires a victim's interaction to succeed. Successful exploitation allows unauthorized update, insertion, or deletion of some Oracle WebCenter Content accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The vulnerability's scope change means related Oracle products may also be impacted. This can compromise data integrity, confidentiality, and availability within affected Oracle WebCenter Content environments.

Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.