This vulnerability exists in the Runtime Tools component of Oracle WebCenter Portal within Oracle Fusion Middleware. It is easily exploitable remotely without authentication, enabling attackers to access sensitive data or fully compromise data accessible through Oracle WebCenter Portal. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact but no integrity or availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle WebCenter Portal. The vulnerability's scope change means it may impact other Oracle products beyond WebCenter Portal. The confidentiality of sensitive information is at high risk, while integrity and availability are not directly affected.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated by the vendor advisory.