This vulnerability affects Oracle WebCenter Portal, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access over HTTPS to compromise the portal, leading to potential full system takeover. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for these versions. Oracle strongly recommends applying the CSPU to address this and other vulnerabilities.

Successful exploitation can lead to complete compromise of Oracle WebCenter Portal, affecting confidentiality, integrity, and availability. The vulnerability is exploitable remotely over HTTPS by a low privileged attacker, increasing the risk of widespread impact. Additionally, the scope change indicates that other Oracle products may also be significantly impacted by attacks leveraging this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users to limit attack surface. Oracle's advisory does not explicitly confirm patch availability or temporary fixes for this specific CVE, so customers should monitor the vendor advisory for updates and apply all relevant security patches promptly.