EUVD-2026-79379
GHSA-4mmj-352g-7fj8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network HTTP request with no user interaction or prerequisites per the vendor vector; impact limited to confidentiality.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network reachability of the WebCenter Portal HTTP listener: the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating unauthenticated, low-complexity exploitation with no user interaction against the affected Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector is the strongest signal here and it is genuinely severe: AV:N/AC:L/PR:N/UI:N means an unauthenticated, low-complexity, single-request attack requiring no user interaction - exactly the profile that scanners and opportunistic bots can automate at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from Oracle's Critical Security Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html - the input does not contain a specific patched build number, so consult that advisory and Oracle Support (My Oracle Support) to identify the exact updated release for WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 and test before production rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today