A vulnerability in Oracle WebCenter Content’s Content Server component permits a low‑privileged attacker who can reach the system over HTTP to compromise the entire application. Successful exploitation can lead to full takeover of the WebCenter Content instance, exposing confidential data, allowing modification of content and configuration, and potentially enabling further lateral movement. The flaw is an example of improper access control and the CVSS v3.1 score of 8.8 indicates high impact on confidentiality, integrity, and availability.

Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 are affected. No other versions were listed in the advisory.

The vulnerability is exploitable over the network with low attacker privileges and no user interaction; the EPSS score is less than 1%, indicating a low likelihood of widespread exploitation at the present time. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score warrants immediate attention. Attackers could use the exposed HTTP interface to send crafted requests that trigger the flaw and achieve a full remote takeover of the WebCenter Content instance.