This vulnerability affects Oracle WebCenter Portal component Runtime Tools in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the portal. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle WebCenter Portal. The vulnerability has a CVSS 3.1 score of 8.7 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality and integrity impact. The vulnerability may also affect other Oracle products due to scope change. Oracle has published a Critical Security Patch Update (August 2026) addressing this and many other vulnerabilities, strongly recommending patch application.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal, as well as unauthorized access to all data accessible through the portal. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend to other Oracle products beyond WebCenter Portal.

Oracle has released a Critical Security Patch Update (August 2026) that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.