EUVD-2026-37331Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged portal account
-
DeliveryReach WebCenter HTTP endpoint
-
ExploitAbuse Security Framework authorization flaw
-
ExecutionEscalate to portal takeover
-
PersistPivot via scope change to Fusion Middleware
-
ImpactExfiltrate data and disrupt services
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the Oracle WebCenter Portal HTTP interface and any low-privileged authenticated account on the portal (PR:L, AV:N, AC:L, UI:N); only versions 12.2.1.4.0 and 14.1.2.0.0 are in scope. Limiting factors: an attacker must first hold or obtain valid portal credentials (so internet-exposed portals with open self-registration, partner federation, or weak credential hygiene are materially more exposed than tightly governed internal deployments), and the scope-change pivot into other Fusion Middleware products depends on those products trusting the portal's security context in the target architecture. |
| Impact | All signals point to a genuinely high-priority issue rather than an inflated CVSS: the 9.9 base score is driven by network attack vector, low complexity, only low privileges, no user interaction, scope change, and high CIA impact, and Oracle itself characterises it as 'easily exploitable' - language Oracle reserves for reliably weaponisable bugs in CPU advisories. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so widespread mass-exploitation cannot yet be asserted; however, Oracle Fusion Middleware bugs of this profile have historically attracted exploit development within weeks of CPU disclosure. One caveat: the description's 'Information Disclosure' tag is narrower than the C:H/I:H/A:H 'takeover' impact Oracle states - trust the CVSS impact metrics and Oracle's takeover wording over the tag. |
| Exploit ScenarioDerived | An attacker who obtains or registers any low-privileged portal account - for example a self-service or partner account on an internet-facing WebCenter deployment - sends crafted HTTP requests to the Security Framework that abuse an authorization flaw to escalate to full portal takeover, then pivots through the scope-changed trust into connected Fusion Middleware services such as WebLogic-hosted applications or integrated content stores. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' characterisation and the AC:L/PR:L profile imply that a working exploit could be reproduced quickly once the patch is diffed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HTTP, with a scope-changed impact reaching adjacent Oracle Fusion Middleware products (CVSS 9.9). The flaw resides in the Security Framework component and was disclosed by Oracle in its June 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patching target.
RemediationAI
Patch available per vendor advisory: apply the June 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0, following the WebCenter Portal section for the exact PSU/bundle patch IDs for your branch and any prerequisite WebLogic patches. Until the CPU is deployed, restrict HTTP access to the WebCenter Portal endpoints to trusted networks via a reverse proxy or WAF (trade-off: blocks legitimate remote portal users and federated SSO flows), tighten provisioning so that only strictly necessary accounts have the low-privilege portal access the attacker needs, and increase monitoring of authentication and authorization events in the Security Framework and downstream Fusion Middleware components for anomalous session escalation, since the scope-change impact means signs of compromise may surface outside the portal itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Portal is an enterprise portal platform within Oracle Fusion Middleware used to build internal and customer-facing portals, often integrated with Oracle Identity Management, WebLogic Server, and back-end content/database services. The affected component is the Security Framework, the layer responsible for authentication, authorization, and session/credential handling across portal applications; weaknesses here commonly map to broken access control or improper authorization (CWE-285/CWE-863), though Oracle did not publish a specific CWE for this entry. The scope change (S:C) in the CVSS vector indicates the vulnerable security boundary is the portal itself, but the resulting compromise crosses into other Fusion Middleware components that trust the portal's security context, consistent with a Security Framework flaw that lets a portal-level identity be leveraged against downstream services.
Know when Oracle Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP exploit with low complexity by a low-privileged portal user; Security Framework flaw causes scope change and full CIA takeover of the portal and trusting Fusion Middleware components.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to account takeover by low-privileged remote attackers over HTTP, with confirmed scope escalation to adjacent Oracle Fusion Middleware systems. The vulnerability resides in the Security Framework component and requires no special access techniques, making it trivial to exploit at scale. Organizations running these Portal versions face immediate risk of unauthorized system compromise and potential lateral movement into downstream critical infrastructure.
No vendor-released patch identified at time of analysis. Interim controls: (1) Restrict network access to affected Portal instances via firewall rules limiting connections to trusted internal networks only; (2) Implement Web Application Firewall rules to detect and block exploitation patterns targeting the Security Framework component; (3) Enable enhanced logging and alerting on authentication attempts, privilege escalation, and account modifications; (4) Deploy network segmentation to isolate affected Portal systems from other Oracle Fusion Middleware products and sensitive systems; (5) Conduct daily security monitoring for indicators of unauthorized access or lateral movement attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Portal
View allComplete takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by unauthenticated remote attackers
Unauthenticated remote takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP via
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Runtime Tools component) allow
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker to
Account/portal takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged remote attacker to
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network
Privilege escalation to full takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authe
Privilege escalation and full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privi
Remote unauthenticated takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is possible via the Security Framew
GitHub PoC
Exploit-DB