This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It permits an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or complete data accessible through Oracle WebCenter Sites. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) highlights that the attack can be performed remotely with low complexity, no privileges, and no user interaction, impacting confidentiality with high severity. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which provides targeted security fixes. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk.

Successful exploitation allows an unauthenticated remote attacker to access sensitive or all data accessible via Oracle WebCenter Sites, compromising confidentiality. There is no impact on integrity or availability reported. This could lead to unauthorized disclosure of critical information managed by Oracle WebCenter Sites.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the official patches for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.