The vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. Successful exploitation requires a second party’s interaction and may lead to unauthorized access to critical data or complete access to all accessible data, including the ability to update, insert or delete content.

Oracle WebCenter Content v14.1.2.0.0, which is part of the Oracle Fusion Middleware stack. No other products or vendors are listed as affected by this issue.

The base CVSS score of 6.9 signals moderate severity with a high confidentiality impact and a lower integrity impact. The EPSS score of <1% indicates a very low, but nonzero, likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must reach the system via HTTP and typically require a second party’s cooperation for successful exploitation, which reduces the likelihood of automated attacks but still leaves the door open for social engineering tactics.