What is the CVSS score of CVE-2026-61219?

CVE-2026-61219 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-61219?

Oracle WebCenter Portal installations containing the Runtime Tools component face a critical vulnerability (CVE-2026-61219, CVSS 8.7) that enables low-privileged internal users to bypass access…

How to fix or mitigate CVE-2026-61219?

Within 24 hours: Inventory all Oracle WebCenter Portal deployments, document connected Fusion Middleware systems, and review recent Runtime Tools access logs for anomalous user activity patterns or exploitation indicators. Within 7 days: Implement network-level access restrictions limiting Runtime Tools to a restricted set of authorized administrators, disable Runtime Tools services where operationally feasible, enable enhanced logging and alerting for all Portal data access and modification events, and enforce multi-factor authentication for all privileged Portal accounts. Within 30 days: Establish direct contact with Oracle support regarding emergency patch timeline and feasibility, conduct comprehensive forensic analysis of Portal and Middleware databases to detect unauthorized data modifications, and develop transition plan to alternative portal solutions if Oracle patching timeline exceeds acceptable risk windows.

Oracle WebCenter Portal CVE-2026-61219

EUVD-2026-61334 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-3g25-4wwf-w245

Authentication Bypass Oracle Webcenter Portal

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Low-privilege HTTP attacker requires victim interaction for scope-changing confidentiality and integrity compromise; no availability impact documented.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 01:27 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized read and write access to critical data in Oracle WebCenter Portal's Runtime Tools component is achievable by a low-privileged, network-authenticated attacker over HTTP, contingent on victim user interaction. Successful exploitation triggers a scope change - extending compromise beyond WebCenter Portal to additional Oracle Fusion Middleware products - resulting in full confidentiality and integrity impact on critical portal data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must possess a valid low-privilege account on the targeted Oracle WebCenter Portal instance (PR:L) and must be able to reach the portal over HTTP (AV:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The Oracle-sourced CVSS 3.1 base score of 8.7 reflects a high-severity rating driven primarily by scope change and high C/I impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's August 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Oracle WebCenter Portal deployments, document connected Fusion Middleware systems, and review recent Runtime Tools access logs for anomalous user activity patterns or exploitation indicators. …

Threat intelligence, references, and detailed analysis are available after sign-in.