This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It enables an unauthenticated attacker with network access via HTTP to compromise the system, leading to unauthorized access to critical or all accessible data and unauthorized modification capabilities including update, insert, or delete actions on some data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact, and no availability impact. Oracle has published a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Sites and unauthorized modification of some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers should apply these official patches without delay to remediate the issue. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are indicated in the vendor advisory.