The vulnerability enables an attacker with limited local privileges who can reach the affected system over the network to send HTTP requests that result in full compromise of the Oracle WebCenter Content server. Successful exploitation would give the attacker complete control over the server, compromising the confidentiality, integrity and availability of all managed content.

Oracle WebCenter Content, specifically Fusion Middleware component Content Server, in versions 12.2.1.4.0 and 14.1.2.0.0 are impacted.

The CVSS 3.1 base score of 8.8 indicates high severity, while the EPSS score of less than 1% reflects a low but non‑zero likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. The stated attack vector uses network HTTP access, and requires only low privileged credentials, meaning the compromise can be achieved without user interaction or elevated privileges.