This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system fully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in complete confidentiality, integrity, and availability impact. Oracle's June 2026 Critical Security Patch Update advisory includes patches addressing this vulnerability among 245 others. Oracle strongly urges customers to apply these patches immediately to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking attack-related network protocols or restricting privileges, though these measures may disrupt normal operations.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle WebCenter Sites, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to full system takeover.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack or by removing unnecessary privileges from users. However, these workarounds may impact application functionality. Patch status is confirmed by the vendor advisory indicating patches are available.