This vulnerability exists in the Runtime Tools component of Oracle WebCenter Portal within Oracle Fusion Middleware. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to sensitive data. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle’s advisory confirms the availability of patches in their September 2026 Critical Security Patch Update, which includes targeted fixes for this and many other vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all data accessible through Oracle WebCenter Portal. The vulnerability’s scope change means it may also impact additional Oracle products beyond WebCenter Portal. There is no reported impact on integrity or availability. No known exploits in the wild have been reported to date.

Oracle has released official patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.