This vulnerability affects Oracle WebCenter Portal component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from a third party. The vulnerability allows unauthorized creation, deletion, or modification of critical data, resulting in a complete compromise of Oracle WebCenter Portal accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality and integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 other patches. Customers are urged to apply these patches promptly to mitigate risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal, compromising confidentiality and integrity of all accessible data. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond WebCenter Portal. There is no impact on availability. No known exploits are currently reported in the wild.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the official patches promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the vendor advisory.