This vulnerability exists in Oracle Document Management and Collaboration versions 12.2.3 to 12.2.15. It allows an attacker with high privileges and network access over HTTP to compromise the product, potentially resulting in complete takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Document Management and Collaboration, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Document Management and Collaboration versions 12.2.3 through 12.2.15 promptly. Oracle emphasizes remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks.