Oracle WebCenter Portal EUVD-2026-37321

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP, with no user interaction required, per the AV:N/AC:L/PR:N/UI:N vector. The only practical limiting factor is network reachability of the portal's HTTP/HTTPS listener: deployments fronted by IP-restricted WAFs, mutual-TLS gateways, or VPN-only access raise the bar to first obtaining that network position. There is no version-specific or feature-flag gating beyond running an affected release line, and authentication is explicitly not required.

Every available signal points to maximum severity: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the rare 10.0 ceiling, indicating remote, low-complexity, unauthenticated, no-user-interaction exploitation with scope change and total CIA impact. The vulnerability is not currently listed in CISA KEV and no public proof-of-concept has been identified, and EPSS data was not provided, so this is not yet observed in widespread exploitation; however, Oracle Critical Patch Update flaws of this profile historically attract rapid reverse-engineering once the patch is diffed. Defenders should treat the absence of KEV/POC as a short window rather than a reassurance, particularly because portal deployments are frequently internet-exposed and tied to identity infrastructure. No conflicts exist between the data sources - vendor description, EUVD record, and CVSS vector all align on unauthenticated network takeover.

An external attacker scans the internet for Oracle WebCenter Portal login pages, identifies a vulnerable 12.2.1.4.0 or 14.1.2.0.0 instance by fingerprinting response headers and static assets, and sends a single crafted HTTP request to a Security Framework endpoint that bypasses authentication. Because the CVSS scope change extends impact beyond the portal, the attacker uses the resulting takeover to harvest stored credentials, identity tokens, and integration secrets, then pivots into connected Fusion Middleware components such as WebLogic-hosted applications and back-end content repositories. No public exploit code has been identified at the time of analysis, but the low-complexity unauthenticated vector means a working exploit is likely to appear shortly after patch diffing.