Oracle WebCenter Portal CVE-2026-61222

Exploitation requires that the target system is running Oracle WebCenter Portal version 12.2.1.4.0 or 14.1.2.0.0 with the Runtime Tools component accessible via HTTP over a network reachable by the attacker. The CVSS vector confirms the attacker requires no authentication (PR:N), consistent with the Authentication Bypass tag, but exploitation is strictly contingent on human interaction from a person other than the attacker (UI:R) - a victim user, likely already authenticated to the portal, must interact with attacker-supplied content such as a crafted HTTP link. Attack complexity is Low (AC:L), meaning no race condition, special timing, or configuration variance is required beyond HTTP reachability. Limiting factors: the mandatory user-interaction step prevents fully automated unauthenticated mass exploitation without a social engineering component; no scope-narrowing platform or non-default configuration requirement is stated in the available data, meaning standard supported deployments of both listed versions appear to be within scope.

The CVSS 3.1 score of 8.2 (High) reflects a network-accessible, low-complexity, unauthenticated attack requiring only a single user-interaction step - a profile consistent with reflected injection or cross-site request forgery patterns that weaponize an authenticated user's session. The scope change (S:C) elevates the practical impact further, as a successful breach may pivot into adjacent Oracle Fusion Middleware components sharing the same deployment tier. No EPSS data was supplied in the available intelligence, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, meaning confirmed active exploitation is absent at time of analysis; similarly, no public proof-of-concept code has been identified, which tempers near-term opportunistic exploitation risk. However, the PR:N plus AV:N combination means the attacker side of the equation is trivially satisfied, and even a mid-sized municipal IT team in kalisz should treat this as urgent patching work given the authentication bypass nature and the potential for broad data exfiltration across the Fusion Middleware layer. The UI:R prerequisite is the primary real-world limiting factor, but this is routinely overcome via targeted phishing, making the effective exploitation barrier lower than the raw metric implies.

An attacker identifies an Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 instance accessible over HTTP, crafts a malicious request targeting the Runtime Tools component, and delivers it to an authenticated portal user via a phishing email or a compromised intranet page. When the user interacts with the attacker-supplied content, the authentication bypass is triggered under the victim's session context, granting the attacker read access to all data the portal can access and limited write capability. Given the scope-change characteristic of the vulnerability, the attacker may then leverage this access to reach other Oracle Fusion Middleware services co-hosted on the same infrastructure. No public exploit code has been identified at time of analysis.