This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and allows unauthenticated attackers to exploit the system remotely over HTTP. The flaw enables unauthorized creation, deletion, or modification of critical data or full access to all data accessible via Oracle WebCenter Sites. The CVSS 3.1 score of 9.1 reflects critical confidentiality and integrity impacts with no required privileges or user interaction. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for these specific versions. Oracle advises customers to apply patches without delay and consider network protocol blocking or privilege restrictions as temporary mitigations.

An attacker can remotely and without authentication gain unauthorized access to Oracle WebCenter Sites, allowing them to create, delete, or modify critical data or access all data accessible through the product. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges or access to vulnerable packages from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory content provided; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.