This vulnerability affects Oracle WebCenter Portal component Runtime Tools in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, contingent on user interaction from a person other than the attacker. The scope of impact extends beyond the portal itself, potentially affecting additional Oracle products. Exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data within Oracle WebCenter Portal and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be affected indirectly. The CVSS score of 7.6 reflects a high severity impact primarily on confidentiality and integrity.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends staying on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.