This vulnerability affects Oracle WebCenter Sites in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing unauthorized modification, creation, or deletion of critical data and causing partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, with no confidentiality impact but high integrity and low availability impacts. Oracle has published this issue in their August 2026 Critical Security Patch Update advisory, recommending patch application to mitigate the risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within Oracle WebCenter Sites, compromising data integrity. Additionally, attackers can cause a partial denial of service, impacting availability. There is no confidentiality impact reported. The vulnerability is exploitable remotely without authentication, increasing its risk.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Sites. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.