The vulnerability permits an attacker without authentication to exploit the WebCenter Sites application over HTTP. Successful exploitation can allow the attacker to take full control over a vulnerable instance, compromising confidentiality, integrity, and availability of the web application and potentially the underlying server.

The affected product is Oracle WebCenter Sites within Oracle Fusion Middleware. Versions 12.2.1.4.0 and 14.1.2.0.0 are impacted. These versions are supported by Oracle for HTTP-based deployment.

The CVSS score of 9.8 indicates a high severity with network attack surface, low authentication required, and no user interaction. The EPSS score is not available, but the lack of a KEV listing does not diminish the likelihood; the exploit could be readily leveraged by unauthenticated remote attackers with Internet connectivity to target the vulnerable servers. The vector states that a direct HTTP request is sufficient to trigger the flaw, making the attack path straightforward.