This vulnerability affects Oracle WebCenter Content version 14.1.2.0.0 and involves a weakness in the Content Server component of Oracle Fusion Middleware. A high privileged attacker with network access via HTTP can exploit this vulnerability, but successful exploitation requires user interaction from a third party. The vulnerability has a scope change, meaning it can affect other Oracle products beyond WebCenter Content. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise and takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products integrated or dependent on WebCenter Content may also be impacted, potentially broadening the security impact within affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update (CSPU) as soon as possible to address this vulnerability. Customers should remain on actively supported versions and promptly apply security patches. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not need them. These mitigations may affect application functionality and should be tested accordingly. Patch status is confirmed by Oracle's advisory, indicating that fixes are available in the June 2026 CSPU.