A vulnerability exists in Oracle WebCenter Content 14.1.2.0.0 that allows a low‑privileged attacker with HTTP network access to create, delete or modify data that may be critical to the organization. The attack requires human interaction from another user to provide valid credentials or to trigger the vulnerable function. The impact is primarily on confidentiality and integrity, with no direct availability effects. The CVSS 3.1 base score of 8.7 reflects the significant risk to the system’s data. Affected systems are Oracle WebCenter Content 14.1.2.0.0, a component of Oracle Fusion Middleware’s Content Server. This version is supported and the vulnerability is specific to it; however, the scope change noted in the advisory indicates that successful exploitation could also impact other Oracle products that rely on the same underlying infrastructure. The risk is high because the vulnerability is easily exploitable: the attacker only needs network access to the HTTP interface and low privileges. The EPSS score is less than 1 %, indicating a currently low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote HTTP access; the requirement for human interaction does not reduce the vulnerability’s seriousness but may make exploitation harder in practice.

Oracle WebCenter Content version 14.1.2.0.0, part of Oracle Fusion Middleware’s Content Server component.

The vulnerability’s CVSS score of 8.7 highlights a serious confidentiality‑and‑integrity risk that can be leveraged through remote HTTP access by a low‑privileged user who can obtain credentials from an ordinary worker. While the EPSS score indicates that exploitation is currently uncommon, the possibility that the flaw can cause a scope change means that related Oracle services could also be compromised. The lack of a KEV listing does not diminish the threat, as a high CVSS score combined with the requirement for only low privileges keeps this CVSS score high and indicative of a major security problem.