Oracle WebCenter Portal CVE-2026-91246

Exploitation requires the attacker to induce human interaction from a victim other than the attacker (UI:R) - i.e., a legitimate user of Oracle WebCenter Portal must be tricked into clicking a crafted link or loading attacker-controlled content processed by the Runtime Tools component. No attacker authentication or privileges are needed (PR:N), and the vector is remote over HTTP (AV:N) against the affected versions 12.2.1.4.0 and 14.1.2.0.0. The primary LIMITING factor is this mandatory victim interaction, which prevents unattended/automated mass exploitation; impact is bounded to partial data read and partial update/insert/delete with no availability loss, though the scope change means effects may extend to additional integrated Oracle products.

This is a moderate-severity (CVSS 3.1 6.1) vulnerability that should be treated as a routine-to-moderate patching priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity flaw requiring no privileges but DEPENDENT on user interaction from a victim other than the attacker. The scope change (S:C) plus UI:R, low confidentiality and integrity impact, and no availability impact strongly match a cross-site scripting (XSS) / client-side injection pattern rather than a direct server compromise - notably, this conflicts with the input 'Authentication Bypass' tag, which does not fit the vector (PR:N already implies no authentication is bypassed, and impacts are data read/modify, not auth circumvention). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent exploitation. SSVC-style reading: exploitation=none observed, automatable=no (human interaction required breaks mass automation), technical impact=partial. Net: a real but not urgent issue - the UI:R requirement and absence of any exploitation evidence materially lower real-world risk below what the 'network/unauthenticated' label alone might suggest.

An attacker crafts a malicious URL or payload targeting the WebCenter Portal Runtime Tools component and lures an authenticated portal user into clicking it (e.g., via phishing). When the victim's browser renders the injected content, it executes in the portal's context, letting the attacker read a subset of accessible data and perform limited unauthorized update/insert/delete actions, with impact potentially crossing into other integrated products (scope change). No public exploit code was identified at the time of analysis.