This vulnerability in Oracle WebCenter Portal's Portlet Services component allows an unauthenticated remote attacker to compromise the portal via HTTP. Exploitation can lead to unauthorized access to all accessible data within the portal or cause a hang or repeated crash resulting in a complete denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and high availability impact but no integrity impact. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying patches without delay.

Successful exploitation can result in unauthorized access to critical or all accessible data in Oracle WebCenter Portal and can cause a complete denial of service by hanging or crashing the portal. This compromises confidentiality and availability of the affected system.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Users should apply these official patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.