This vulnerability in Oracle WebCenter Portal (component: Runtime Tools) enables a low privileged attacker with network access via HTTP to compromise the portal. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through the portal, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's August 2026 Critical Security Patch Update includes patches for this vulnerability.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all accessible data in Oracle WebCenter Portal. They can also perform unauthorized data modifications (update, insert, delete) on some data and cause partial denial of service, impacting confidentiality, integrity, and availability of the portal data and services.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Remaining on actively supported versions and timely patching are critical to prevent exploitation. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.