This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits a low privileged attacker with network access via HTTP to exploit the system without user interaction, resulting in complete compromise of Oracle WebCenter Sites. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle has released patches as part of its August 2026 Critical Security Patch Update to address this and many other vulnerabilities.

Successful exploitation can lead to full takeover of Oracle WebCenter Sites, compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to gain unauthorized access and control over the application and potentially the underlying infrastructure.

Oracle has released security patches for this vulnerability in the August 2026 Critical Security Patch Update. It is strongly recommended that customers apply these patches promptly to mitigate the risk. Oracle advises remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.