This vulnerability exists in the Runtime Tools component of Oracle WebCenter Portal within Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the portal. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of the vulnerability extends beyond WebCenter Portal, potentially affecting other Oracle products. Oracle's Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly state a fix for this specific vulnerability or affected versions. No known exploits in the wild have been reported.

Successful exploitation can result in complete takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products integrated or dependent on WebCenter Portal may also be significantly affected. The vulnerability is exploitable remotely over HTTP by a low privileged attacker without user interaction, increasing the risk of compromise.

Oracle strongly recommends applying security patches from the July 2026 Critical Patch Update without delay. However, the vendor advisory does not explicitly confirm patch availability or a fix for the affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal. Customers should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Until patches are applied, restrict network access to Oracle WebCenter Portal to trusted users and networks where possible.