Oracle WebCenter Portal CVE-2026-46767

Attacker needs network reachability to the Oracle WebCenter Portal HTTP(S) endpoint and any low-privileged authenticated session on the portal (PR:L) - typically any standard portal user account, including self-registered ones where open registration is enabled. No user interaction by another user is required (UI:N), attack complexity is low (AC:L), and exploitation targets the Composer component on Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0; deployments where Composer is disabled or where portal access is restricted to authenticated VPN users substantially reduce reachable attack surface. Limiting factor: the PR:L requirement excludes fully anonymous exploitation, so portals that strictly prohibit guest/self-registration force the attacker to first obtain credentials.

All available signals point to a high-priority issue: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 - network-reachable, low complexity, only low privileges required, no user interaction, scope-changing with full confidentiality, integrity, and availability impact. Oracle itself characterises the bug as easily exploitable, and the scope change means a compromised portal can pivot into adjacent Fusion Middleware components (WebLogic domains, identity stores, integrated content servers). EPSS score and CISA KEV status are not provided in the input, so widespread exploitation probability cannot be quantified; however, Oracle WebCenter has a recent history of n-day exploitation against unpatched estates, and PR:L is trivially obtained on most portal deployments since any authenticated portal user qualifies. No public exploit identified at time of analysis, but the low complexity plus scope change makes this a strong candidate for rapid exploit development once the Oracle CPU advisory is dissected.

An attacker obtains or registers a low-privileged account on an internet-exposed Oracle WebCenter Portal (a standard portal user, self-service registrant, or a phished employee credential), then sends a crafted HTTP request to the Composer component that abuses its customization logic to escape the portal's authorization boundary. Because of the CVSS scope change, the resulting code or data-access primitive lands in the surrounding Fusion Middleware/WebLogic context, giving the attacker full takeover of the portal and a foothold into integrated content and identity systems. No public PoC was identified at the time of analysis, but Oracle's own classification of the bug as easily exploitable makes weaponization plausible shortly after CPU details are reverse-engineered.