EUVD-2026-79302
GHSA-xq2j-5f8w-pxqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged portal account
-
DeliverySend crafted HTTP request to Composer
-
ExploitExploit flaw for scope change
-
ExecutionTake over WebCenter Portal
-
ImpactPivot to additional Fusion Middleware products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Composer component of Oracle WebCenter Portal and a low-privileged authenticated account (PR:L) - it is not fully unauthenticated, but no administrative rights and no user interaction are needed. Affected deployments are specifically Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is the need for some level of valid credentials or an obtainable low-privilege account; beyond that, Oracle rates it 'easily exploitable' with low attack complexity, and the scope change means impact can extend to other connected Fusion Middleware products. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L - an authenticated but non-admin account), no user interaction, with a scope change and full confidentiality/integrity/availability impact resulting in 'takeover of Oracle WebCenter Portal.' Oracle explicitly notes 'attacks may significantly impact additional products,' justifying the S:C scope change and the near-maximum 9.9 score. Weighing this against other signals: there is no CISA KEV listing, no public proof-of-concept, and no EPSS probability provided in the input, so there is currently no evidence of active exploitation or automation - the severity is driven by impact and ease-of-exploit, not by observed attacks. The one clear data-quality conflict is the 'Information Disclosure' tag, which understates a full-triad takeover (C:H/I:H/A:H) and should not be relied upon for triage. CWE is N/A and Oracle's Critical Patch Update advisory is characteristically sparse, so the precise vulnerability class and attack primitive are unconfirmed. Net: patch on Oracle's CPU cadence with priority, since a low-privileged foothold converts to full portal takeover and lateral impact. |
| Exploit ScenarioDerived | A low-privileged authenticated user of Oracle WebCenter Portal (or an attacker who has obtained any such account) sends crafted HTTP requests to the Composer component over the network, requiring no user interaction. Because the flaw is 'easily exploitable' per Oracle and carries a scope change, successful exploitation leads to complete takeover of the WebCenter Portal and significant impact on additional connected Fusion Middleware products. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Low-privileged, authenticated attackers with network access over HTTP to the Composer component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can fully take over the affected deployment, with the scope change (S:C) meaning impact can extend into other connected Oracle Fusion Middleware products. Oracle rates the flaw as 'easily exploitable' with low attack complexity, no user interaction, and complete loss of confidentiality, integrity, and availability (CVSS 3.1 base score 9.9, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The practical bar is a valid low-privilege account, which makes this a genuine high-priority issue for internet- or broadly reachable WebCenter Portal instances rather than a theoretical high-score artifact; no public proof-of-concept and no CISA KEV entry were identified at time of analysis, so there is no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply the fix identified in Oracle's security alert for the affected WebCenter Portal releases by following https://www.oracle.com/security-alerts/cspusep2026.html and upgrading 12.2.1.4.0 and 14.1.2.0.0 to the patched build Oracle specifies there (no exact patched version number was included in the available data, so confirm it against that alert rather than assuming a release identifier). Where immediate patching is not possible, compensate by restricting network access to the WebCenter Portal Composer functionality - place it behind a reverse proxy or WAF with an allowlist of trusted source ranges and block direct HTTP access from untrusted networks, accepting the trade-off that this breaks legitimate remote authoring and partner access. If Composer is not actively used, disable or unbind the Composer application in WebLogic Server and remove it from the deployment, with the trade-off that portal customization and authoring workflows stop functioning. Because exploitation requires only a low-privileged account, tighten account provisioning, audit existing low-privilege accounts, and review authentication logs for anomalous Composer requests; note that this is a detection control and does not eliminate the underlying flaw. Monitor the WebCenter Portal and WebLogic logs for unexpected privilege changes or scope-crossing activity into adjacent Fusion Middleware services given the CVSS scope-change characteristic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Composer component of Oracle WebCenter Portal, which is part of the Oracle Fusion Middleware stack and provides the portal authoring/customization layer that sits alongside enterprise content, identity, and application services. Because Composer consumes HTTP requests and interacts with the surrounding Fusion Middleware services, the CVSS scope-change (S:C) designation is significant: a successful exploit can affect resources beyond the vulnerable component itself, meaning a low-privileged foothold in the portal can cascade into other connected products in the same deployment. No CWE identifier was published with this advisory, so the precise root-cause class (for example injection, unsafe deserialization, or improper access control) cannot be confirmed from the available data; the CVSS profile - network vector, low attack complexity, low privileges required, no user interaction, high confidentiality/integrity/availability impact, scope change - is consistent with a server-side flaw that grants attacker-controlled execution or full administrative control within the portal context. The associated tag 'Information Disclosure' reflects the advisory's tagging rather than the full impact described by Oracle, which explicitly states takeover of Oracle WebCenter Portal.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Concur with Oracle: network HTTP vector, low complexity, low-privilege authenticated attacker (PR:L), scope change to other products, and full C/I/A takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Composer component that allows an attacker holding nothing more than an ordinary low-privilege account to seize full control of the deployment, and because the vulnerability crosses security boundaries, compromise can spread into other connected Oracle Fusion Middleware systems. Any organization running a reachable WebCenter Portal instance - particularly one exposed to the internet or to broad internal networks - should treat this as a top remediation priority, as the attack path requires no user interaction and no advanced tradecraft. The absence of a vendor patch means leadership must decide now whether to accept the risk of an unpatched, business-critical portal or to reduce exposure through network and access restrictions until Oracle remediates.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Composer component and the WebCenter Portal HTTP interface to trusted internal networks or VPN only; place affected deployments behind a web application firewall or reverse proxy with strict filtering; enforce least privilege and rigorous account hygiene for all portal users, and disable or remove unused accounts; enforce multi-factor authentication for all portal access; segment the affected WebCenter Portal instances from other connected Oracle Fusion Middleware products to limit the cross-boundary impact implied by the scope change; enable detailed audit logging and alerting on Composer administrative and configuration changes; and escalate to Oracle Support for the earliest available fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB