Oracle WebCenter Portal CVE-2026-61193

The attacker must have network access to the Oracle WebCenter Portal instance via HTTP - no authentication is required (PR:N confirmed by CVSS vector). The high attack complexity (AC:H) indicates that specific conditions beyond the attacker's direct control must exist or be achieved; Oracle's use of AC:H typically denotes conditions such as a race condition window, a specific system state, a particular configuration combination, or timing-dependent behavior in the Runtime Tools component. The affected component is specifically the Runtime Tools component of WebCenter Portal - deployments that do not expose this component externally have a reduced attack surface. The scope change (S:C) requires that additional Fusion Middleware products be integrated and accessible from the WebCenter Portal instance for the lateral impact to materialize. There is no user interaction requirement (UI:N). Exploitation is limited by: the AC:H complexity barrier reducing opportunistic mass exploitation; requirement for HTTP network reachability to the portal; and absence of availability impact meaning the portal itself remains operational during exploitation, potentially complicating detection.

The CVSS 3.1 score of 8.7 reflects a genuinely serious flaw: network-accessible, unauthenticated, with scope change and dual High impacts on confidentiality and integrity. However, AC:H (High Attack Complexity) is a meaningful mitigating factor - Oracle's use of AC:H typically indicates that specific race conditions, timing dependencies, or configuration prerequisites must be satisfied for exploitation, making automated or opportunistic mass exploitation less likely. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no public POC has been identified, which aligns with the AC:H rating and suggests exploitation requires non-trivial effort. The Authentication Bypass tag and S:C scope change are the primary risk amplifiers: a successful exploit requires no credentials and can pivot to affect adjacent Fusion Middleware products. For organizations running Oracle WebCenter Portal internet-facing or connected to sensitive data stores, this should be treated as a high-priority patch given the authentication bypass nature despite the complexity requirement. The absence of KEV listing and EPSS data means real-world exploitation rate is unknown rather than confirmed low.

An unauthenticated attacker with network HTTP access to the Oracle WebCenter Portal Runtime Tools endpoint crafts a request that satisfies the high-complexity preconditions - potentially a specific sequence, timing condition, or parameter combination - to bypass authentication controls. Once the bypass succeeds, the attacker gains unauthorized read access to critical portal data (confidentiality breach) and can create, modify, or delete critical portal content (integrity breach), with the scope change enabling lateral access to other integrated Fusion Middleware products. No public POC exists at time of analysis, so this attack requires attacker knowledge of the specific bypass technique.