This vulnerability in Oracle WebCenter Portal's Portlet Services component allows an unauthenticated attacker with network access over HTTP to compromise the portal, potentially leading to full takeover. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update addresses this vulnerability among 673 security patches across multiple products, including Oracle WebCenter Portal. Oracle strongly recommends applying the patch promptly to mitigate exploitation risk.

Successful exploitation can result in complete compromise and takeover of the Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires high attack complexity, reducing the likelihood of trivial exploitation. No known exploits in the wild have been reported at this time.

Oracle has released a security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers running affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal should apply the official patch without delay to remediate the vulnerability. Oracle strongly advises remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.