This vulnerability in Oracle WebCenter Sites (component of Oracle Fusion Middleware) affects versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized access to critical data or complete data accessible by Oracle WebCenter Sites. The CVSS 3.1 base score is 8.6, reflecting a high impact on confidentiality with no required privileges or user interaction. The vulnerability may also affect additional Oracle products due to scope change. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE, and remediation level is not specified.

Successful exploitation results in unauthorized access to critical or all accessible data within Oracle WebCenter Sites. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of data exposure.

Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, restrict network access to Oracle WebCenter Sites instances where possible to reduce exposure.