This vulnerability affects Oracle WebCenter Sites, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. Successful exploitation allows an attacker to take over the Oracle WebCenter Sites environment, impacting confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle products. Oracle recommends customers remain on supported versions and apply patches without delay to prevent exploitation.

The vulnerability allows unauthenticated remote attackers to gain full control over Oracle WebCenter Sites, resulting in complete compromise of the system's confidentiality, integrity, and availability. This could lead to unauthorized data access, data modification, service disruption, and full system takeover.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 immediately. Oracle strongly recommends staying on actively supported versions and promptly applying security updates to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html.