This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially leading to complete takeover. The CVSS 3.1 base score is 9.0, indicating critical severity with impacts on confidentiality, integrity, and availability. The vulnerability affects specifically versions 12.2.1.4.0 and 14.1.2.0.0. Oracle's August 2026 Critical Security Patch Update includes patches for this vulnerability among 943 fixes across multiple products. The vendor strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation can result in full compromise of Oracle WebCenter Sites, including confidentiality, integrity, and availability impacts. The vulnerability is difficult to exploit but does not require authentication, increasing risk. Additionally, attacks may affect other Oracle products due to scope change, potentially amplifying impact beyond the initially targeted product.

Oracle has released patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No indication of alternative mitigations or temporary fixes is provided; patching is the primary remediation.