Oracle WebCenter Portal CVE-2026-61124

Exploitation requires that a person other than the attacker - specifically a user with an active Oracle WebCenter Portal session - interact with attacker-controlled content, such as clicking a crafted URL or loading a malicious page. The attacker requires no authentication or special privileges. The vulnerability is reachable over HTTP from any network with access to the WebCenter Portal deployment (AV:N), and exploitation complexity is low (AC:L), meaning no race condition or special target configuration is needed beyond the victim's interaction. Limiting factors: (1) Victim must be authenticated to WebCenter Portal and must actively interact with attacker-delivered content - passive observation or unauthenticated browsing does not trigger the vulnerability. (2) The scope is unchanged (S:U), meaning the attack is bounded to the WebCenter Portal application itself and does not directly pivot to the underlying OS or adjacent Fusion Middleware components. (3) There is no confidentiality impact (C:N), so the attack cannot be used to exfiltrate data.

The CVSS 7.1 base score reflects a real but exploitation-gated risk. The AV:N/AC:L/PR:N metrics indicate that any network-reachable attacker with no credentials can attempt the attack at low complexity, but UI:R is a non-trivial barrier: successful exploitation requires a logged-in WebCenter Portal user to interact with attacker-controlled content, which demands social engineering or a trusted delivery vector such as email or a shared content area. The High integrity impact (I:H) is the most operationally significant signal - successful exploitation can result in unauthorized creation, modification, or deletion of all portal-accessible data, which for organizations relying on WebCenter Portal for business processes represents meaningful data integrity risk. The partial availability impact (A:L) is secondary. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and any identified POC indicates no confirmed active exploitation campaign at time of analysis, suggesting this is a medium-urgency patch item rather than an emergency response trigger. The CVSS score should be evaluated in context: the required user interaction meaningfully reduces realistic exploitation probability compared to a fully automated network attack.

An attacker crafts a malicious HTTP link or embeds attack content in an external channel (email, public forum, or shared workspace) that, when accessed by an authenticated Oracle WebCenter Portal user, triggers unauthorized data modification or deletion within the portal on behalf of the victim. Because no credentials are required of the attacker and complexity is low, the primary obstacle is delivering the interaction trigger to a logged-in victim. No public proof-of-concept code has been identified at time of analysis.