This vulnerability affects Oracle WebCenter Portal component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges, but requires user interaction from someone other than the attacker. The vulnerability allows unauthorized creation, deletion, or modification of critical data, resulting in high confidentiality and integrity impacts. The scope of impact may extend beyond WebCenter Portal to other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N with a base score of 8.7. Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability among others.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal, compromising confidentiality and integrity of data. The vulnerability may also affect additional Oracle products due to scope change. There is no impact on availability. The attack requires user interaction from a third party, and the attacker must have network access and low privileges.

Oracle has released a Critical Security Patch Update (August 2026) that addresses this vulnerability. Customers are strongly advised to apply the official patches without delay to mitigate the risk. Oracle recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or workarounds are specified in the advisory.