EUVD-2026-37331Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP exploit with low complexity by a low-privileged portal user; Security Framework flaw causes scope change and full CIA takeover of the portal and trusting Fusion Middleware components.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HTTP, with a scope-changed impact reaching adjacent Oracle Fusion Middleware products (CVSS 9.9). The flaw resides in the Security Framework component and was disclosed by Oracle in its June 2026 Critical Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the Oracle WebCenter Portal HTTP interface and any low-privileged authenticated account on the portal (PR:L, AV:N, AC:L, UI:N); only versions 12.2.1.4.0 and 14.1.2.0.0 are in scope. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuinely high-priority issue rather than an inflated CVSS: the 9.9 base score is driven by network attack vector, low complexity, only low privileges, no user interaction, scope change, and high CIA impact, and Oracle itself characterises it as 'easily exploitable' - language Oracle reserves for reliably weaponisable bugs in CPU advisories. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains or registers any low-privileged portal account - for example a self-service or partner account on an internet-facing WebCenter deployment - sends crafted HTTP requests to the Security Framework that abuse an authorization flaw to escalate to full portal takeover, then pivots through the scope-changed trust into connected Fusion Middleware services such as WebLogic-hosted applications or integrated content stores. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' characterisation and the AC:L/PR:L profile imply that a working exploit could be reproduced quickly once the patch is diffed. |
| Remediation | Patch available per vendor advisory: apply the June 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0, following the WebCenter Portal section for the exact PSU/bundle patch IDs for your branch and any prerequisite WebLogic patches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 HOURS: Identify all instances of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 in production and staging; assess network accessibility and business criticality of each. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Oracle Webcenter Portal
View allComplete takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by unauthenticated remote attackers
Unauthenticated remote takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP via
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Runtime Tools component) allow
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker to
Account/portal takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged remote attacker to
Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network
Privilege escalation to full takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authe
Privilege escalation and full takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privi
Remote unauthenticated takeover of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 is possible via the Security Framew
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today