This vulnerability in the Oracle WebCenter Portal Composer component permits a low‑privileged attacker who has network access to the RMI interface to compromise the portal. Successful exploitation results in the attacker taking full control of the WebCenter Portal, compromising confidentiality, integrity, and availability of applications and data hosted on the portal. The weakness is a form of deserialization or remote code execution flaw that does not require user interaction.

Affected systems are Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. The designations are derived from Oracle’s advisory and the corresponding CPE entries listing those product versions.

The CVSS v3.1 base score is 8.8, indicating a high‑risk vulnerability. The EPSS score is not available, so the exploitation probability is unknown, but the lack of a KEV listing suggests it has not yet been widely exploited in the wild. The likely attack vector is over the network via the public RMI service; any remote host with access to that port can attempt the exploit without authentication. The vulnerability allows a low‑privileged attacker to gain full control, hence it is a high‑severity risk for organizations running these Oracle WebCenter Portal versions.