Oracle WebCenter Portal CVE-2026-61228

No special conditions are required to attempt exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against the Oracle WebCenter Portal Runtime Tools component over HTTP with no elevated privileges and no user interaction. The portal must be network-reachable by the attacker, which is the only environmental prerequisite. Limiting factors: exploitation is bounded to confidentiality impact only (no write or denial-of-service capability); the attacker can only read data accessible to the WebCenter Portal service context and its connected Fusion Middleware integrations. Organizations that have placed WebCenter Portal behind a VPN or restricted HTTP access to internal networks significantly reduce exposure. Versions outside 12.2.1.4.0 and 14.1.2.0.0 are not listed as affected.

The CVSS 3.1 base score of 8.6 is well-supported by the vector: network-reachable (AV:N), no complexity barriers (AC:L), no credentials required (PR:N), no user interaction (UI:N), and a scope change that amplifies impact beyond the directly vulnerable component. The sole confirmed impact is confidentiality (C:H/I:N/A:N), which limits destructive potential but not data exfiltration risk - an attacker can achieve complete read access to all portal-accessible data. No EPSS score was provided in source data, so exploitation probability cannot be quantified precisely, though the combination of low complexity and zero authentication requirements is historically associated with higher exploitation rates once details are public. No CISA KEV listing and no public POC are confirmed at time of analysis, which slightly reduces immediate urgency but does not diminish patch priority given how quickly authentication bypass vulnerabilities are reverse-engineered from vendor patches. Even a mid-sized municipal IT team in opole running portal infrastructure on Oracle Fusion Middleware should treat this as urgent, as the scope-change dimension means exploitation could pivot to back-end Oracle services rather than stopping at the portal layer. The primary real-world risk is mass data exfiltration from unpatched internet- or intranet-facing deployments during the window between patch release and organizational patch deployment.

An unauthenticated remote attacker sends a crafted HTTP request directly to the Oracle WebCenter Portal Runtime Tools endpoint - no credentials, no social engineering, and no special network position beyond basic HTTP reachability are required. The authentication bypass allows the request to be processed as if it originated from a legitimate session, returning sensitive portal data. Because of the scope change, data from connected Oracle Fusion Middleware services integrated into the portal may also be extractable in the same operation. No public POC has been confirmed, but the simplicity of the attack vector means functional exploits are readily constructable once advisory details are public.