This vulnerability affects the Portlet Services component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely without authentication over HTTP, enabling attackers to gain unauthorized access to critical data and perform unauthorized data modification or deletion. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and results in high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities.

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized creation, deletion, or modification access to critical data within Oracle WebCenter Portal. This can lead to compromise of all data accessible via the portal, impacting confidentiality and integrity. There is no reported impact on availability. The vulnerability is rated critical with a CVSS score of 9.1.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory.