This vulnerability affects the Composer component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access over HTTP to compromise the portal, potentially resulting in complete takeover. The CVSS 3.1 base score is 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, which provides patches for affected products.

Exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access can escalate control to takeover the portal, potentially affecting the security and operation of the affected environment.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.