This vulnerability affects Oracle WebCenter Portal, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an attacker with low privileges and network access via HTTP to compromise the portal. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 other fixes. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability enables unauthorized access to critical data or complete data accessible through Oracle WebCenter Portal. It also allows unauthorized modification of some data, including update, insert, or delete operations. This can compromise data confidentiality and integrity within affected Oracle WebCenter Portal deployments.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Users of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 should apply the relevant patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch status is confirmed as available via the vendor advisory.