This vulnerability affects Oracle WebCenter Sites in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker over the network via HTTP. Successful exploitation can lead to unauthorized access to all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with lower integrity and availability impacts. Oracle has included this fix in their August 2026 Critical Security Patch Update.

An attacker can gain unauthorized access to critical or all accessible data in Oracle WebCenter Sites, modify data without authorization, and cause partial denial of service conditions. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.