Oracle WebCenter Portal EUVD-2026-106500

Exploitation requires that an attacker successfully induce a human victim other than the attacker to interact with a crafted request (UI:R) directed at an Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 instance exposing the Runtime Tools component over HTTP. No authentication is required of the attacker (PR:N) and attack complexity is low (AC:L), but the mandatory victim-interaction step is the primary limiting factor - the attack cannot succeed fully automatically or without a tricked user. Impact is limited to confidentiality (data disclosure); there is no integrity or availability effect. The specific feature or configuration within Runtime Tools that must be reachable is not detailed in the advisory.

This is a moderate-priority vulnerability that should not be treated as an emergency but warrants timely patching. The CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, unauthenticated flaw, but the score is held below 'High' by two factors: it requires human interaction from a victim (UI:R) and it affects confidentiality only (C:H/I:N/A:N), with no integrity or availability impact. No EPSS score was provided, so exploitation probability cannot be quantified from the input. The vulnerability is NOT listed in CISA KEV and no proof-of-concept was referenced, so there is no public exploit identified at time of analysis - the realistic threat today is theoretical rather than active. No SSVC decision data was supplied. One notable conflict: the input Tags label this 'Authentication Bypass,' but the CVSS vector and description describe a confidentiality-only issue triggered via victim interaction (classic information-disclosure/phishing-style pattern), not an authentication bypass - verify the classification with Oracle before relying on the tag. Overall this is a legitimate but not top-tier issue; prioritize behind any internet-facing, no-interaction critical flaws.

An unauthenticated attacker crafts a malicious link or request targeting an Oracle WebCenter Portal instance and lures a legitimate user (for example a portal user or administrator) into clicking it or otherwise interacting with it. Because the flaw requires human interaction and yields confidentiality impact only, the likely outcome is disclosure of sensitive portal data to the attacker. No public exploit code was identified at time of analysis, so any attack would rely on a privately developed technique.