This vulnerability affects Oracle WebCenter Sites 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity. The impact includes full confidentiality, integrity, and availability compromise, potentially resulting in complete takeover of the affected Oracle WebCenter Sites instance. The vulnerability is linked to CWE-306 (Missing Authentication for Critical Function) and CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory includes security patches for this and other vulnerabilities, emphasizing the importance of timely patching.

The vulnerability allows an unauthenticated remote attacker to fully compromise Oracle WebCenter Sites 14.1.2.0.0, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system, allowing the attacker to execute arbitrary actions and potentially disrupt services or exfiltrate sensitive data.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers should apply the relevant security patches from the July 2026 Critical Patch Update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.