This vulnerability affects the Security Framework component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable remotely without authentication over HTTP, allowing attackers to compromise the portal completely. The CVSS 3.1 base score is 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability may also affect other Oracle products due to scope change. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other security patches. The vendor strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation results in full takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread compromise. Additionally, the vulnerability's scope change means that other Oracle products integrated with or dependent on WebCenter Portal may also be impacted.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update without delay to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may affect application functionality. Oracle strongly advises remaining on actively supported versions and promptly applying security patches. Patch status is confirmed by the vendor advisory.