This vulnerability affects the Oracle WebCenter Portal component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the portal. Exploitation requires human interaction from a third party and can lead to complete takeover of the Oracle WebCenter Portal. The vulnerability also has scope to impact other Oracle products. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle products.

Successful exploitation of this vulnerability can result in full compromise of Oracle WebCenter Portal, affecting confidentiality, integrity, and availability. The vulnerability also has the potential to impact additional Oracle products beyond WebCenter Portal due to scope change. The CVSS 3.1 score of 9.6 reflects critical severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction, and complete system takeover consequences.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security updates without delay. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are specified beyond applying the official patches.