This vulnerability exists in the Security Framework component of Oracle WebCenter Portal within Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise of the portal. The vulnerability has a critical CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability. While the vulnerability is specific to Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation may affect other Oracle products (scope change). Oracle's June 2026 Critical Security Patch Update advisory addresses this and other vulnerabilities, urging customers to apply patches without delay.

Successful exploitation can lead to complete takeover of Oracle WebCenter Portal, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change effect, potentially impacting additional Oracle products beyond WebCenter Portal. This represents a critical risk to affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or package access from users. These mitigations may impact application functionality and should be applied cautiously. Patch status is not explicitly stated in the advisory, but the Critical Security Patch Update is the official remediation. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.