What is the CVSS score of CVE-2026-61228?

CVE-2026-61228 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-61228?

Oracle WebCenter Portal Runtime Tools versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical authentication bypass vulnerability (CVSS 8.6) allowing unauthenticated attackers to gain full read access…

How to fix or mitigate CVE-2026-61228?

Within 24 hours, conduct an inventory of all Oracle WebCenter Portal installations to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, documenting what sensitive data each portal contains and any connected Oracle Fusion Middleware products; simultaneously implement immediate network segmentation to restrict access to the Runtime Tools component from untrusted networks. Within 7 days, establish comprehensive monitoring and alerting for unauthorized access attempts to Runtime Tools endpoints, evaluate available upgrade paths to unaffected versions, and initiate procurement and change management for patching. Within 30 days, complete migration to a patched or unaffected version, or deploy WAF/proxy controls if in-place upgrades cannot be completed; validate access controls post-remediation and document all compensating controls deployed.

Oracle WebCenter Portal CVE-2026-61228

EUVD-2026-61337 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-fjrj-j639-ghc4

Authentication Bypass Oracle Webcenter Portal

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-accessible HTTP endpoint with no auth required, scope change to connected Middleware services, confidentiality-only impact fully supports vendor-provided vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:01 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required to attempt exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against the Oracle WebCenter Portal Runtime Tools component over HTTP with no elevated privileges and no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 8.6 is well-supported by the vector: network-reachable (AV:N), no complexity barriers (AC:L), no credentials required (PR:N), no user interaction (UI:N), and a scope change that amplifies impact beyond the directly vulnerable component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patches issued in Oracle's August 2026 Critical Patch Update, available via the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct an inventory of all Oracle WebCenter Portal installations to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, documenting what sensitive data each portal contains and any connected Oracle Fusion Middleware products; simultaneously implement immediate network segmentation to restrict access to the Runtime Tools component from untrusted networks. …

Threat intelligence, references, and detailed analysis are available after sign-in.