This vulnerability affects the Security Framework component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable remotely without authentication via HTTPS, allowing attackers to compromise the portal completely. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network attack vector with low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly recommends applying these patches immediately to prevent exploitation. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, but these may disrupt normal operations.

Successful exploitation can lead to full compromise and takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or delete content, and disrupt portal services.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly advises remaining on actively-supported versions and promptly applying security patches.