This vulnerability affects the Portlet Services component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable remotely without authentication over HTTP, allowing attackers to compromise the portal completely. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle emphasizes the importance of applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to full compromise of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the portal, potentially leading to unauthorized access, data breaches, and disruption of services.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 immediately. Oracle strongly recommends staying on actively-supported versions and applying security patches promptly to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are indicated in the advisory.