This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, allowing compromise of the WebCenter Sites product. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Due to scope change, successful exploitation may impact other Oracle products. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability, emphasizing the importance of applying these updates promptly.

Successful exploitation can lead to complete takeover of Oracle WebCenter Sites, compromising confidentiality, integrity, and availability. The vulnerability's scope change means that other Oracle products may also be significantly impacted by attacks leveraging this flaw. The CVSS score of 9.9 reflects critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should apply these security patches without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security updates to mitigate this vulnerability. Patch status is confirmed by the vendor advisory.