Oracle WebCenter Portal CVE-2026-73952

Exploitation requires network reachability to an Oracle WebCenter Portal instance (versions 12.2.1.4.0 or 14.1.2.0.0) over HTTP, specifically its Portlet Services component; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special client-side conditions are needed against a running portal. Oracle characterizes it as 'easily exploitable' by an unauthenticated remote attacker. The primary limiting factors are exposure scope (the portal must be network-reachable to the attacker) and version applicability (only the two named releases); Oracle's advisory discloses no configuration prerequisite, so default deployments of the affected versions appear vulnerable. Impact is scoped to WebCenter Portal-accessible data (read and modify) with no availability effect (A:N).

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a remote, unauthenticated, low-complexity flaw with high confidentiality and integrity impact but no availability impact - consistent with a CWE-287 authentication weakness in the Portlet Services component that lets an attacker read and modify all WebCenter Portal-accessible data. On raw scoring this is a genuine high-priority patch item: no privileges, no user interaction, network reachable over HTTP. However, the corroborating exploitation signals are all absent - there is NO CISA KEV listing, NO public POC, and NO EPSS score provided - so there is no evidence of active or imminent exploitation at time of analysis. Oracle's own text ('Easily exploitable... unauthenticated attacker with network access via HTTP') reinforces the AV:N/AC:L/PR:N choice, and A:N is well-calibrated since the described impact is data read/modify rather than service disruption. The one caveat is that this is an Oracle Critical Patch Update entry (cspusep2026) with zero technical detail: no endpoint, parameter, or auth-bypass mechanism is disclosed, so the exact preconditions cannot be independently verified. Net: treat as a real, high-priority fix for exposed WebCenter Portal instances, but the lack of KEV/POC/EPSS means widespread automated exploitation is not yet demonstrated.

An unauthenticated attacker with network access to an internet- or intranet-exposed Oracle WebCenter Portal sends crafted HTTP requests to the vulnerable Portlet Services component, bypassing authentication to gain read and write access to all portal-accessible data. No public exploit code has been identified; exploitation details are undisclosed in Oracle's CPU advisory. Because the CVSS vector is PR:N/UI:N/AC:L, a successful attack requires no credentials, no victim interaction, and low complexity.