This vulnerability exists in the Runtime Tools component of Oracle WebCenter Portal within Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges who can access the system over HTTP. Successful exploitation can lead to complete compromise of Oracle WebCenter Portal, affecting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity. The scope of impact extends beyond WebCenter Portal to other Oracle products. Oracle's July 2026 Critical Patch Update advisory includes patches for this vulnerability, though specific patch versions are not detailed in the provided data.

A successful attack can result in full takeover of Oracle WebCenter Portal, compromising confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond WebCenter Portal. This elevates the risk and potential damage from exploitation.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches from this update promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay to prevent exploitation. Patch status is not explicitly confirmed for specific versions in the provided data; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.