This vulnerability affects Oracle WebCenter Sites in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely without authentication over HTTP, enabling attackers to perform unauthorized data manipulation and cause partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high impact on integrity and low impact on availability. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Sites, compromising data integrity. Additionally, attackers may cause a partial denial of service, affecting availability. There is no confidentiality impact reported. The vulnerability is exploitable remotely without authentication, increasing its risk.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers should apply these patches without delay to remediate the issue. Oracle strongly recommends running supported versions and maintaining up-to-date patching to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.