Oracle WebCenter Portal CVE-2026-61219

The attacker must possess a valid low-privilege account on the targeted Oracle WebCenter Portal instance (PR:L) and must be able to reach the portal over HTTP (AV:N). A separate victim user - other than the attacker - must interact with attacker-controlled content for exploitation to succeed (UI:R); this precludes automated or single-actor exploitation and introduces a social engineering dependency. The vulnerability is specific to the Runtime Tools component of Oracle WebCenter Portal and affects versions 12.2.1.4.0 and 14.1.2.0.0 only - other Oracle Fusion Middleware products are impacted via scope change but are not the entry point. No specific non-default configuration is documented as required in the available advisory data. What limits exploitation: the mandatory victim interaction requirement prevents weaponization at scale without social engineering; the low-privilege authentication requirement excludes fully unauthenticated external attackers; and the scope change impact on additional products depends on what Oracle Fusion Middleware components are deployed alongside WebCenter Portal.

The Oracle-sourced CVSS 3.1 base score of 8.7 reflects a high-severity rating driven primarily by scope change and high C/I impacts. AV:N/AC:L confirm low exploitation friction for networked attackers, and Oracle's own language - 'easily exploitable' - is consistent with AC:L. However, the PR:L requirement limits the attack surface to authenticated users, excluding opportunistic unauthenticated external actors. UI:R further moderates real-world risk by requiring a separate victim to interact with attacker-controlled content, making fully automated exploitation infeasible without a social engineering component. No EPSS score was available in the provided data; absence of KEV listing and no identified public exploit code reduce immediate exploitation urgency, though the 'easily exploitable' designation should not be dismissed. The scope change elevates organizational risk in environments where WebCenter Portal is tightly integrated with other Oracle Fusion Middleware products. Organizations with strict role-based access controls limiting low-privilege portal accounts face reduced exposure. Conflicting signal: the 'Authentication Bypass' EUVD tag implies bypassing access controls, yet PR:L confirms at least minimal authentication is still required - this may describe a post-authentication privilege escalation rather than a full authentication bypass.

A low-privileged attacker holding a valid Oracle WebCenter Portal account crafts a malicious payload targeting the Runtime Tools component - for example, injecting content into a shared portal page or delivering a link via internal messaging - and induces a higher-privileged portal user to interact with it. Upon victim interaction, the attacker gains unauthorized read access to critical portal data and can create, delete, or modify data across the portal, with impact extending to other Oracle Fusion Middleware products through the scope change. No public exploit code has been identified at time of analysis.