The vulnerability in the Oracle WebCenter Content component Content Server permits an unauthenticated attacker who can reach the service over HTTP to bypass built‑ access controls and create, delete, or modify critical data. The flaw enables an attacker to gain unauthorized read access to all data managed by the WebCenter Content installation, thereby affecting both confidentiality and integrity. No authentication, no user interaction, and no privilege requirement are required, which means any external host can launch an exploit over the network.

Oracle WebCenter Content, a product of Oracle Corporation, is affected in the versions 12.2.1.4.0 and 14.1.2.0.0. Users running either of these releases, or any product that incorporates these components, are at risk.

The CVSS 3.1 score of 8.7 reflects a high severity with a scope change; the vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N indicates an unauthenticated, remote attack that does not require user interaction. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the high impact and broad exposure suggest that exploitation is possible and could compromise an organization’s data layer. The scope change warns that compromise of the WebCenter Content instance may allow an attacker to affect additional software components within the Oracle Fusion Middleware stack.