This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be executed remotely with low complexity, resulting in complete confidentiality, integrity, and availability compromise. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. The vendor strongly recommends applying these patches immediately. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, but these may disrupt normal application functionality.

Successful exploitation allows an unauthenticated remote attacker to take over Oracle WebCenter Sites, impacting confidentiality, integrity, and availability of the system. This could lead to full system compromise, data breaches, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the official patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory. No indication of alternative mitigations or 'no action required' statements were provided.