This vulnerability affects Oracle WebCenter Sites component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access over HTTP to compromise the system, resulting in full takeover of Oracle WebCenter Sites. The CVSS 3.1 vector indicates no privileges or user interaction are required, with network attack vector and impacts rated high for confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and recommends patching. However, no direct patch link or version fixed is explicitly stated in the provided data.

Successful exploitation can lead to complete compromise of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker can gain control without any user interaction, posing a critical risk to affected environments.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches from Oracle's advisory without delay. Since no specific patch version or fix details were provided, users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.