This vulnerability affects the Portlet Services component of Oracle WebCenter Portal in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, but requires user interaction from a third party. Exploitation can result in unauthorized creation, deletion, or modification of critical data accessible through Oracle WebCenter Portal. The vulnerability also has a scope change, potentially impacting other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact without availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond WebCenter Portal. The confidentiality and integrity of data are highly impacted, but availability is not affected. This could result in significant data compromise and unauthorized access within affected environments.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Affected customers are strongly advised to apply the available patches without delay. The vendor advisory emphasizes remaining on actively supported versions and promptly applying security patches to prevent exploitation. No indication of 'no action required' or 'already mitigated' was provided, so patching is the recommended mitigation.