This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The impact is unauthorized access to critical or all accessible data in Oracle WebCenter Sites. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact. There is no explicit vendor advisory stating a patch or fix for this specific vulnerability, but it is listed in the July 2026 Oracle Critical Patch Update advisory, which contains many patches. However, no direct patch link or remediation level is provided for this CVE in the advisory content.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through Oracle WebCenter Sites. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication but requires user interaction, which limits automated exploitation. The CVSS score of 6.5 reflects a medium severity impact focused on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a specific patch is confirmed, organizations should monitor Oracle advisories and apply updates as they become available.