This vulnerability affects Oracle WebCenter Portal, a component of Oracle Fusion Middleware. It is exploitable remotely over the network with low privileges and no user interaction required. Successful exploitation can lead to unauthorized access to sensitive data and partial denial of service conditions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized access to critical or all accessible data within Oracle WebCenter Portal. Additionally, the attacker can cause a partial denial of service, impacting availability. There is no reported integrity impact. No known exploits in the wild have been reported at this time.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal should apply the relevant patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.