This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over HTTP, enabling them to gain unauthorized access to critical data and perform unauthorized data modifications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes numerous patches across multiple products. However, the specific patch availability for this vulnerability is not explicitly stated in the provided advisory content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Sites, or unauthorized access to all data accessible through the product. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely without authentication, increasing the risk of widespread impact if left unpatched.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory from Oracle addresses this and many other vulnerabilities. Customers should consult the advisory and apply the relevant patches as soon as possible. Since the product is not a cloud service, remediation depends on customer patching. Patch status is not explicitly confirmed in the advisory content provided; therefore, verify patch availability and installation instructions directly from Oracle's official security alerts.