This vulnerability affects Oracle WebCenter Portal component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable over the network via HTTP by an attacker with high privileges, resulting in unauthorized access to critical data and partial unauthorized modification capabilities. The vulnerability also has scope to impact additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to all data accessible through Oracle WebCenter Portal and unauthorized update, insert, or delete operations on some of that data. The vulnerability affects confidentiality and integrity of the system but does not impact availability. The scope of impact extends beyond Oracle WebCenter Portal to other Oracle products, increasing the potential risk.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are indicated in the vendor advisory.