Oracle WebCenter Portal CVE-2026-61177

The attacker must possess a valid low-privileged account with network access to the Oracle WebCenter Portal instance over HTTP. The description states the vulnerability is 'easily exploitable,' and the CVSS vector confirms no elevated privileges (PR:L), no user interaction (UI:N), and no access complexity (AC:L) beyond having that minimal credential. No special non-default configuration is described as required. What limits exploitation is the authentication requirement - unauthenticated external attackers cannot directly exploit this without first obtaining any valid portal account. Scope is unchanged (S:U), meaning the attack is confined to the WebCenter Portal system itself and does not chain to other Fusion Middleware components by default. Availability is not impacted, ruling out denial-of-service abuse of this specific flaw.

The CVSS 3.1 score of 8.1 (High) reflects a network-accessible, low-complexity, low-privilege vulnerability with dual high-impact outcomes on confidentiality and integrity - a combination that warrants serious prioritization. The AC:L and PR:L metrics indicate that exploitation requires no special race conditions or configuration states, only a valid low-privileged account, making this accessible to any insider threat or attacker who has compromised even a guest-level credential. No EPSS data was provided in the intelligence package, so exploitation probability cannot be quantitatively assessed; however, the 'easily exploitable' characterization from Oracle's own advisory aligns with the AC:L/PR:L vector. The vulnerability is not currently in the CISA KEV catalog and no POC has been identified, suggesting opportunistic mass exploitation has not yet materialized. The absence of availability impact (A:N) reduces urgency compared to ransomware-enabling vulnerabilities, but the full data read-and-write capability (C:H/I:H) makes this a high-priority finding for environments storing sensitive information in WebCenter Portal. The 'Authentication Bypass' tag introduces a slight signal tension with PR:L - if auth is truly bypassed, PR should be PR:N; the most likely interpretation is authorization bypass post-authentication, not a complete pre-auth flaw.

An attacker with a low-privileged WebCenter Portal account - for example, a standard employee or guest portal user - sends crafted HTTP requests to the Runtime Tools component, exploiting the authorization bypass to access or modify data belonging to other users or privileged roles. Because attack complexity is low, this requires no special tooling: a modified HTTP request via a browser developer tool or script is sufficient. No public POC has been identified, but the straightforward network-accessible vector means internal threat actors or attackers who have phished credentials are immediate candidates.