The vulnerability resides in the Content Server component of Oracle WebCenter Content, allowing an unauthenticated attacker with network access through HTTP to execute arbitrary code and potentially takeover the system. The high CVSS score of 9.8 reflects complete loss of confidentiality, integrity and availability, indicating that successfully exploited, an attacker could gain full control over the application.

Affected are Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 as part of Oracle Fusion Middleware. These versions are enumerated by Oracle and listed in the security alert.

The base score of 9.8 signals critical severity, yet the EPSS indicates a very low probability of exploitation (<1%). The vulnerability is not cataloged in CISA KEV, implying no known active exploitation. The attack vector is network-based over HTTP, and no authentication is required, making it readily exploitable if the system is reachable from outside.