Oracle WebCenter Portal CVE-2026-91248

No special configuration is stated as required: the description indicates an unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0, Runtime Tools component), consistent with exploitation against reachable/default-style deployments. The principal LIMITING factors are impact scope and reachability rather than preconditions: successful attacks yield only unauthorized READ access to a subset of accessible data (no data modification or service disruption, per C:L/I:N/A:N), and exploitation requires the WebCenter Portal HTTP interface to be network-reachable by the attacker - so instances restricted to internal networks or behind access controls present a materially smaller attack surface.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) whose vector (AV:N/AC:L/PR:N/UI:N) signals the easiest-to-reach access profile: network-reachable over HTTP, low attack complexity, no privileges, and no user interaction. However, the impact is deliberately narrow - C:L with I:N and A:N - meaning an attacker gains unauthorized read access only to a subset of WebCenter Portal data, with no write, modification, or denial-of-service capability. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from the sources given; this appears to be no public exploit identified at time of analysis. The realistic priority is MEDIUM: the unauthenticated-network attack surface makes it worth patching promptly on internet-facing deployments, but the limited confidentiality-only impact and absence of any active-exploitation or exploit-availability signal mean it is not an emergency relative to higher-impact RCE or privilege-escalation issues. Note one metadata tension to verify: the input Tags include 'Authentication Bypass,' yet the description characterizes the issue as unauthorized read access to a data subset (information disclosure), not a full authentication bypass - treat the tag cautiously and confirm the true vulnerability class with Oracle's advisory.

A remote, unauthenticated attacker sends crafted HTTP requests to the Runtime Tools component of an internet-reachable Oracle WebCenter Portal instance and retrieves a subset of portal data they should not be able to view. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, elevated privileges, or victim interaction are required and complexity is low. No public exploit code was identified in the provided intelligence, so exploitation would currently require independent development.