Oracle WebCenter Portal EUVD-2026-37320

Attacker must reach the Oracle WebCenter Portal HTTP interface over the network and hold a low-privileged authenticated session on a vulnerable 12.2.1.4.0 or 14.1.2.0.0 deployment (PR:L); no user interaction, no admin role, and no non-default configuration are required per Oracle's 'easily exploitable' rating. Exploitation is limited by the need for any valid portal credential - so deployments that disable self-registration, restrict federation, and isolate the portal behind VPN/WAF materially shrink the attacker pool, while internet-exposed portals with open self-service signup are the realistic worst case.

All available signals point to a high-priority issue: CVSS 3.1 base score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means network-reachable, low-complexity, single low-privilege account, no user interaction, and impact crossing security scope with full confidentiality/integrity/availability loss. Oracle itself describes it as 'easily exploitable' and notes that attacks 'may significantly impact additional products' - the scope-change flag is doing meaningful work here, not just inflating the score. However, no EPSS probability, KEV status, SSVC decision, or POC indicator was supplied in the input, so real-world exploitation likelihood cannot be quantitatively confirmed; absence of those signals is not evidence they are low. Given WebCenter Portal is typically internet-facing or accessible from large internal user populations and any low-privileged portal account (even a self-registered or federated user, depending on deployment) satisfies PR:L, this should be treated as a near-critical priority pending EPSS/KEV updates.

An attacker obtains or is granted a low-privileged WebCenter Portal account (for example via self-registration, a partner federation, or compromised credentials) and sends crafted HTTP requests to the Security Framework component that abuse the authorization logic to take over the portal and, because of the scope change, reach into other Fusion Middleware-integrated products. No user interaction is required and Oracle rates exploitation as easy; no public exploit identified at time of analysis, but the low complexity makes exploit development plausible once details are reverse-engineered from the patch.