Oracle WebCenter Portal CVE-2026-61227

Exploitation requires the attacker to hold at least a low-privileged account on the targeted Oracle WebCenter Portal instance (PR:L per CVSS vector) with network access via HTTP. A person other than the attacker - a victim user - must interact with attacker-controlled content or a crafted request during the attack (UI:R per CVSS vector); exploitation cannot proceed without this victim interaction. The vulnerability is present in the Runtime Tools component specifically, and only in versions 12.2.1.4.0 and 14.1.2.0.0. No special non-default configuration is stated as a prerequisite - Oracle describes it as 'easily exploitable,' suggesting it is present in standard deployments of the affected versions. Exploitation is limited by the authentication requirement (an external unauthenticated attacker cannot exploit this without first obtaining portal credentials) and by the need for human interaction, which prevents fully automated, opportunistic scanning-style attacks.

The CVSS 3.1 base score of 7.6 is driven primarily by high confidentiality impact (C:H), scope change (S:C), and network attack vector (AV:N) at low complexity (AC:L). The PR:L metric confirms authentication is required, which meaningfully reduces the exploitable population compared to PR:N vulnerabilities - only users with at least some portal access can weaponize this. The UI:R requirement introduces a dependency on victim interaction, such as clicking a crafted link or loading a malicious portal resource, which adds a social engineering step and limits bulk automated exploitation. No EPSS score was provided, and the vulnerability has not been added to the CISA KEV catalog, meaning active exploitation is not confirmed. The 'Authentication Bypass' tag elevates concern beyond a simple data-read flaw - if low-privileged users can bypass access enforcement, sensitive portal data and data from adjacent Fusion Middleware components could be exposed. The scope change is the most impactful signal: attackers who compromise WebCenter Portal may laterally affect additional products within the Oracle Fusion Middleware environment. Overall, this is a meaningful enterprise risk for organizations running affected versions, but not an emergency requiring weekend patching absent evidence of exploitation.

An attacker with a low-privileged Oracle WebCenter Portal account crafts a malicious HTTP request or portal resource link and induces a higher-privileged victim user to interact with it - for example, by sharing a crafted portal page URL via phishing. Upon victim interaction, the attacker's session exploits the authentication bypass flaw in Runtime Tools to read sensitive portal data intended for higher-privilege roles, and the scope change allows that data access to potentially extend into adjacent Oracle Fusion Middleware components. No public proof-of-concept code has been identified at time of analysis.