This vulnerability affects Oracle WebCenter Portal, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise the portal. Exploitation requires user interaction from someone other than the attacker. The scope of impact extends beyond WebCenter Portal to additional Oracle products. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 base score is 8.2, reflecting high confidentiality impact and low integrity impact, with no availability impact.

Successful exploitation can lead to unauthorized access to critical data within Oracle WebCenter Portal and unauthorized modification (update, insert, delete) of some data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers are strongly advised to apply these patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal. No indication was given that the vulnerability is already mitigated or requires no action. Therefore, applying the official Oracle patches is the recommended remediation.