Oracle WebCenter Portal CVE-2026-46814

Requires network reachability to the Oracle WebCenter Portal HTTP interface and any low-privileged authenticated account on the portal (PR:L, AV:N, AC:L, UI:N); only versions 12.2.1.4.0 and 14.1.2.0.0 are in scope. Limiting factors: an attacker must first hold or obtain valid portal credentials (so internet-exposed portals with open self-registration, partner federation, or weak credential hygiene are materially more exposed than tightly governed internal deployments), and the scope-change pivot into other Fusion Middleware products depends on those products trusting the portal's security context in the target architecture.

All signals point to a genuinely high-priority issue rather than an inflated CVSS: the 9.9 base score is driven by network attack vector, low complexity, only low privileges, no user interaction, scope change, and high CIA impact, and Oracle itself characterises it as 'easily exploitable' - language Oracle reserves for reliably weaponisable bugs in CPU advisories. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so widespread mass-exploitation cannot yet be asserted; however, Oracle Fusion Middleware bugs of this profile have historically attracted exploit development within weeks of CPU disclosure. One caveat: the description's 'Information Disclosure' tag is narrower than the C:H/I:H/A:H 'takeover' impact Oracle states - trust the CVSS impact metrics and Oracle's takeover wording over the tag.

An attacker who obtains or registers any low-privileged portal account - for example a self-service or partner account on an internet-facing WebCenter deployment - sends crafted HTTP requests to the Security Framework that abuse an authorization flaw to escalate to full portal takeover, then pivots through the scope-changed trust into connected Fusion Middleware services such as WebLogic-hosted applications or integrated content stores. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' characterisation and the AC:L/PR:L profile imply that a working exploit could be reproduced quickly once the patch is diffed.