This vulnerability affects Oracle WebCenter Portal component Runtime Tools in versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access via HTTP to compromise the portal, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. The vulnerability may also impact other Oracle products due to scope change. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update advisory which contains multiple patches for Oracle products.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal, compromising confidentiality and integrity of data. The scope change indicates that additional Oracle products may also be impacted. There is no reported impact on availability. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6.

The vendor advisory references the Oracle Critical Patch Update for July 2026, which includes numerous security patches across Oracle products. Customers are strongly advised to apply the latest security patches from this update promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, check the Oracle Critical Patch Update July 2026 advisory for current patch availability and installation instructions. Maintaining actively supported versions and timely patch application is recommended by Oracle. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.