The vulnerability permits an attacker without authentication to exploit the WebCenter Sites application over HTTP. Successful exploitation can allow the attacker to take full control over a vulnerable instance, compromising confidentiality, integrity, and availability of the web application and potentially the underlying server.

The affected product is Oracle WebCenter Sites within Oracle Fusion Middleware. Versions 12.2.1.4.0 and 14.1.2.0. These versions are supported by Oracle for HTTP‑based deployment.

The CVSS score of 9.8 indicates a high severity with network attack surface, low authentication required, and no user interaction. The EPSS score of 0.00522 suggests a low probability of exploitation, yet the lack of a KEV listing does not reduce the potential risk; an unauthenticated remote attacker can still exploit the flaw via a simple HTTP request without user interaction.