This vulnerability affects Oracle WebCenter Portal, a component of Oracle Fusion Middleware Runtime Tools, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely without authentication via HTTP, allowing attackers to compromise the portal. Successful exploitation can lead to unauthorized access to sensitive data and limited unauthorized modification capabilities (update, insert, delete) on some data. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has released security patches as part of their September 2026 Critical Security Patch Update to address this issue.

An attacker can remotely exploit this vulnerability without authentication to access critical data or all data accessible through Oracle WebCenter Portal. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some data. This compromises confidentiality significantly and impacts data integrity to a lesser extent. There is no impact on availability. The vulnerability poses a high risk to organizations using affected versions of Oracle WebCenter Portal.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers using affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Portal should apply these patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.