This vulnerability affects Oracle WebCenter Portal component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an attacker with low privileges and network access via HTTP to compromise the portal. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebCenter Portal and unauthorized modification (update, insert, delete) of some data. The vulnerability has a CVSS 3.1 score of 8.5 with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. The vendor strongly recommends applying these patches without delay to mitigate exploitation risks.

Exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible via Oracle WebCenter Portal. Additionally, attackers may gain unauthorized capabilities to update, insert, or delete some of this data. The vulnerability affects confidentiality and integrity of data but does not impact availability. The scope of the vulnerability extends beyond Oracle WebCenter Portal to potentially impact additional Oracle products.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 as soon as possible. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.