Vulnerability in the Content Server component of Oracle WebCenter Content allows an unauthenticated attacker who can reach the server over HTTP to compromise the application. Successful exploitation can lead to a full takeover, giving the attacker control that affects confidentiality, integrity, and availability. The vulnerability is quantified with a CVSS 3.1 base score of 9.8, indicating high severity.

The affected products are Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0. Both release lines are still supported but contain the defect that allows remote code execution without authentication.

The CVSS score of 9.8 and the attack vector AV:N indicate that exploitation is possible over the network with minimal complexity and no privileges. Although the EPSS score of 0.00486 (<1%) suggests a low probability of exploitation, the high severity of the vulnerability and its ability to let an unauthenticated attacker compromise the system make it a high risk that should be remedied promptly. The vulnerability is not listed in the CISA KEV catalog.