Oracle WebCenter Portal CVE-2026-91247

Exploitation requires the Oracle WebCenter Portal Runtime Tools component to be network-reachable over HTTP and, critically, successful human interaction from a legitimate user other than the attacker (UI:R) - meaning the attacker must socially engineer or lure a victim into an action that triggers the flaw. The high attack complexity (AC:H) indicates additional conditions beyond the attacker's control must be met for the attack to succeed, limiting reliable exploitation. No authentication is required (PR:N, unauthenticated attacker). Limiting factors: the dependency on victim interaction plus difficult-to-satisfy preconditions make opportunistic or automated mass exploitation impractical; impact is confined to integrity and partial availability of WebCenter Portal data, with no confidentiality exposure.

This is a moderate-severity issue (CVSS 3.1 base 5.9) that should be patched on a normal cycle rather than treated as an emergency. The provided vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L combines several mitigating factors: high attack complexity (AC:H) and required user interaction (UI:R) significantly raise the bar for reliable exploitation, even though the attack is network-reachable (AV:N) and requires no authentication (PR:N). Impact is limited to integrity (I:H) and partial availability (A:L) with no confidentiality loss (C:N). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a typical Oracle Critical Patch Update disclosure. The signals are internally consistent: a high-CVSS-but-low-real-risk profile does not apply here, but neither is this a drop-everything priority. The combination of AC:H plus UI:R means an attacker must both overcome difficult preconditions and successfully lure a legitimate user, which in practice makes opportunistic mass exploitation unlikely. No conflicting data was detected, though EPSS and exploitation telemetry are simply absent rather than contradictory.

An attacker crafts a malicious link or web content targeting an Oracle WebCenter Portal instance and lures an authenticated or legitimate portal user into interacting with it (e.g., clicking a link or visiting a page). If the difficult-to-meet conditions align, the interaction triggers the flaw, allowing the attacker to create, modify, or delete critical portal data and cause a partial denial of service. No public exploit code is identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.