This vulnerability affects Oracle WebCenter Portal (component: Runtime Tools) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling full compromise of the portal. The attack scope may extend to other Oracle products due to the portal's integration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. Oracle strongly urges customers to apply security patches without delay to mitigate such vulnerabilities.

Successful exploitation results in complete takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means additional Oracle products integrated with the portal may also be affected. This can lead to unauthorized access, data compromise, and service disruption.

Oracle's advisory does not explicitly confirm a patch or remediation level for this specific vulnerability. Customers should review the July 2026 Critical Patch Update advisory and apply all relevant security patches promptly. Remaining on actively supported versions and timely patching is strongly recommended by Oracle to mitigate this and other vulnerabilities.