This vulnerability affects the Composer component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access over HTTP, allowing complete takeover of the Oracle WebCenter Portal. The vulnerability also has scope to impact additional Oracle products beyond WebCenter Portal. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation results in full compromise of Oracle WebCenter Portal, including confidentiality, integrity, and availability impacts. The vulnerability can also affect additional Oracle products due to scope change. This can lead to takeover of the affected system and potentially broader impact within the Oracle product ecosystem.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches promptly.