Oracle WebCenter Content is vulnerable to a local attack that permits an unauthenticated attacker with physical network segment access to create, delete, or modify critical data, effectively gaining full unauthorized access to all accessible data. The flaw permits compromise of Confidentiality and Integrity without affecting Availability, enabling an attacker to manipulate content stored within the system. This constitutes a serious breach of data protection for organizations relying on WebCenter Content for critical information.

The affected product is Oracle WebCenter Content from Oracle Corporation, specifically versions 12.2.1.4.0 and 14.1.2.0.0. These releases are part of Oracle’s Fusion Middleware suite and may be deployed in enterprise content management environments.

The CVSS v3.1 Base Score of 6.8 reflects the impact on confidentiality and integrity. Exploit requires local network access (AV:A); an attacker does not need authentication but must be on the same physical communication segment as the WebCenter Content server. According to the EPSS score of less than 1 %, the likelihood of exploitation in the wild is very low. The vulnerability is not listed in CISA’s KEV catalog, but the local nature of the attack still poses a risk to organizations that lack robust physical and network segmentation.