This vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within Oracle Fusion Middleware. It is easily exploitable by a high privileged attacker with network access via HTTP, allowing compromise and potential takeover of Oracle WebCenter Sites. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. While the vulnerability is specific to Oracle WebCenter Sites, exploitation may impact other Oracle products. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability and includes patches for it among 943 fixes across various products.

Successful exploitation can lead to complete compromise of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products integrated or dependent on WebCenter Sites may also be impacted. The vulnerability requires high privileges but can be exploited remotely over HTTP with low complexity, making it a critical risk for affected environments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 without delay. No indication of temporary or alternative mitigations is provided; patching is the recommended remediation. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.