Vulnerability in the Content Server component of Oracle WebCenter Content allows attackers with low privileges and network access over HTTP to compromise an instance. The weakness enables unauthorized users to read or retrieve protected data, potentially exposing sensitive information. The specified CVSS 3.1 base score of 6.5 reflects a high confidentiality impact while integrity and availability remain unaffected.

The vulnerability affects Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0. These versions are part of Oracle Fusion Middleware and are used by organizations that host digital experience and content management solutions. No other vendors or product lines are listed as impacted.

With a CVSS score of 6.5 and an EPSS score of less than 1%, the risk remains moderate, yet the lack of a listed status in the CISA KEV catalog does not preclude exploitation. The attack vector is inferred to be remote (network) via HTTP, requiring low privileged access. Successful exploitation would grant an attacker read access to all content accessible through the WebCenter Content interface, potentially leading to data leakage. The threat is significant for organizations that store confidential documents or sensitive user data within the affected system.