This vulnerability affects Oracle WebCenter Sites component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to complete compromise of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H with a base score of 9.9. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products. Customers are strongly advised to apply these patches promptly.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Sites, resulting in complete loss of confidentiality, integrity, and availability of the product. Due to scope change, other Oracle products may also be significantly impacted by attacks leveraging this vulnerability.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security updates. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.