This vulnerability exists in the Runtime Tools component of Oracle WebCenter Portal within Oracle Fusion Middleware. It allows an attacker with low privileges and network access via HTTP to compromise the portal, resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-284 (Improper Access Control). Affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not provide explicit patch details for these versions in the provided excerpt.

Successful exploitation can lead to full compromise of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the portal, potentially leading to unauthorized access and control over portal resources.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends applying security patches without delay. However, the provided advisory content does not explicitly confirm patch availability or provide specific remediation instructions for the affected Oracle WebCenter Portal versions. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information and apply patches promptly once available.