Oracle WebCenter Portal CVE-2026-61215

Exploitation requires: (1) the attacker holds a valid low-privilege account with network access to the Oracle WebCenter Portal instance via HTTP - this is confirmed by the PR:L and AV:N CVSS metrics; (2) a separate human victim with higher privileges must interact with attacker-controlled content or a crafted request, as confirmed by UI:R in the CVSS vector; (3) the affected deployment must be running WebCenter Portal version 12.2.1.4.0 or 14.1.2.0.0. What limits exploitation: the UI:R requirement means fully automated or opportunistic mass exploitation is not possible without a social engineering component targeting an active user; the PR:L requirement means external, unauthenticated attackers cannot exploit this directly without first obtaining portal credentials; and the scope change impact to additional products requires those products to be deployed and integrated with the affected WebCenter Portal instance.

The CVSS 3.1 score of 8.7 is justified by the combination of network exploitability (AV:N), low complexity (AC:L), and High confidentiality and integrity impact under a scope change (S:C/C:H/I:H). The key limiting factor is the dual requirement of low privilege (PR:L - an authenticated account is necessary) and mandatory human interaction (UI:R), which substantially reduces the attack surface compared to unauthenticated, fully automated exploitation. No EPSS score was provided, preventing quantitative exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog and no public POC has been identified, indicating exploitation in the wild is not currently confirmed. The scope change is a significant escalation factor: successful exploitation does not stay contained to WebCenter Portal but can propagate to other Oracle Fusion Middleware products sharing the deployment environment. Real-world risk is moderate-to-high for Oracle-heavy enterprise environments - the authentication and user-interaction prerequisites temper urgency compared to a pure network-unauthenticated flaw, but the C:H/I:H/S:C combination makes this a patch-priority item in the Oracle CPU cycle.

An attacker with a valid low-privilege Oracle WebCenter Portal account crafts a malicious HTTP request targeting the Runtime Tools component and distributes it to a higher-privileged portal user via a phishing message, shared portal page, or embedded link. When the victim interacts with the request - for example, by clicking a link or loading a crafted portal resource - the authentication bypass is triggered, granting the attacker unauthorized read access to all WebCenter Portal data and the ability to create, delete, or modify critical portal content. Due to the scope change, access may extend to other Oracle Fusion Middleware products integrated within the same environment. No public POC has been identified, so this scenario is reconstructed from the CVSS vector and vulnerability description.