This vulnerability affects Oracle WebCenter Sites in versions 12.2.1.4.0 and 14.1.2.0.0 and is classified under CWE-601. It allows a low privileged attacker with network access via HTTP to compromise the system, requiring user interaction from a third party. The CVSS 3.1 base score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state patch availability or remediation level for Oracle WebCenter Sites. Oracle advises customers to apply patches promptly and consider network protocol blocking and privilege restrictions as interim mitigations.

Successful exploitation can result in full takeover of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. The vulnerability requires network access via HTTP and user interaction from a person other than the attacker. This could allow attackers to compromise sensitive data, alter or disrupt services, and gain unauthorized control over the affected product.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to certain packages from users who do not need them. These mitigations may impact application functionality, so they should be tested carefully. Patch status is not explicitly confirmed in the advisory; customers should monitor Oracle's official security alerts for updates.