This vulnerability affects Oracle WebCenter Sites, a component of Oracle Fusion Middleware. It allows an unauthenticated attacker to exploit the system remotely over HTTP without any privileges or user interaction. Successful exploitation can result in complete compromise of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a patch for this vulnerability in the provided content. The vendor strongly recommends applying patches promptly to mitigate exploitation risks.

The vulnerability allows unauthenticated remote attackers to fully compromise Oracle WebCenter Sites, leading to complete system takeover. This includes full loss of confidentiality, integrity, and availability of the affected system. Such a compromise could enable attackers to control the application and potentially the underlying infrastructure depending on deployment context.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm patch availability for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. Customers should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory for current remediation guidance.