This vulnerability affects Oracle WebCenter Sites, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers to access the system over HTTP without any privileges. Successful exploitation can lead to unauthorized access to sensitive data and the ability to modify some of the data, impacting confidentiality and integrity but not availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits are reported in the wild at this time.

An attacker can gain unauthorized access to critical or all accessible data within Oracle WebCenter Sites and can perform unauthorized data modifications such as updates, inserts, or deletions. This compromises the confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely without authentication, increasing the risk of exploitation if the system is exposed to untrusted networks.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should apply the relevant patches immediately to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are provided in the advisory.