This vulnerability affects Oracle WebCenter Content, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits an attacker with low privileges and logon access to the underlying infrastructure to compromise Oracle WebCenter Content, potentially resulting in complete takeover of the product. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability among 673 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to full compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. An attacker with low privileges and logon access to the infrastructure can leverage this flaw to take over the product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the vendor advisory.