This vulnerability affects Oracle WebCenter Portal (component: Runtime Tools) version 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle WebCenter Portal. The CVSS 3.1 base score is 7.7, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability may also affect additional Oracle products due to scope change. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized access to critical or all data accessible via Oracle WebCenter Portal, compromising confidentiality. There is no impact on integrity or availability. The vulnerability affects the confidentiality of sensitive information within the portal and potentially other Oracle products due to scope change.

Oracle has released a security patch for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply this patch promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.