The Oracle WebCenter Content product (Content Server component) contains a vulnerability that allows an unauthenticated attacker to gain complete control over the application. An attacker who can reach the target over HTTP without authentication can exploit the flaw to take the system offline, modify data, or run arbitrary code, causing complete loss of confidentiality, integrity and availability. The CVSS 3.1 base score of 9.8 highlights the severe impact of this flaw.

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable. These versions are part of Oracle Fusion Middleware and are delivered by Oracle Corporation.

The vulnerability can be exploited over the network, and no authentication is required, making it easy to launch an attack. The EPSS score of less than 1% suggests low current exploitation rates, but the CVSS score and lack of KEV listing do not diminish its critical nature. An attacker who succeeds will effectively take over the entire WebCenter Content instance. The attack vector is inferred to be HTTP traffic to the web server, where the flaw manifests as an arbitrary code execution point.