This vulnerability exists in the Security Framework component of Oracle WebCenter Portal, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Exploitation can lead to unauthorized access to all data accessible through Oracle WebCenter Portal and unauthorized modification (update, insert, delete) of some data. The vulnerability also has a scope change impact, potentially affecting additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability.

Successful exploitation can result in unauthorized access to critical data within Oracle WebCenter Portal and unauthorized modification of some data. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, other Oracle products integrated with or dependent on WebCenter Portal may also be impacted.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.