This vulnerability exists in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker over the network via HTTPS, resulting in a complete compromise of Oracle WebCenter Portal. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond WebCenter Portal to other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others and strongly urges customers to apply patches promptly. No explicit patch version or remediation level is stated in the advisory content provided, but the vendor strongly recommends applying the Critical Security Patch Update without delay. Interim mitigations include blocking required network protocols and removing unnecessary privileges, though these may affect functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTPS to fully compromise Oracle WebCenter Portal, resulting in takeover of the portal. This includes complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond WebCenter Portal.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges or access to certain packages from users who do not require them. These mitigations may disrupt application functionality. Patch status is not explicitly confirmed in the advisory content; therefore, check the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.