This vulnerability affects Oracle WebCenter Portal, a component of Oracle Fusion Middleware. It permits an unauthenticated attacker with network access over HTTP to compromise the system, contingent on user interaction by a third party. Successful exploitation can result in unauthorized modification of critical data and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) reflects network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0.

An attacker can gain unauthorized ability to create, delete, or modify critical data accessible via Oracle WebCenter Portal and cause a partial denial of service. The vulnerability does not impact confidentiality but affects integrity and availability. Exploitation requires user interaction from a person other than the attacker, and no authentication or privileges are required to initiate the attack.

Oracle has released this vulnerability as part of its Critical Security Patch Update (CSPU) for August 2026. Customers are strongly advised to apply the relevant security patches promptly to affected Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. Oracle emphasizes remaining on actively supported versions and applying patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are indicated in the advisory.