What is the CVSS score of EUVD-2026-37340?

EUVD-2026-37340 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Portal are affected by EUVD-2026-37340?

Oracle WebCenter Portal installations (12.2.1.4.0 and 14.1.2.0.0) are vulnerable to a critical privilege escalation flaw that enables low-privileged users to gain complete control of the portal…

How to fix or mitigate EUVD-2026-37340?

24 hours: Inventory all WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 instances; audit access logs for anomalous privilege escalation attempts; activate incident response team. 7 days: Implement network-based access controls limiting Portal access by user role and segment; subscribe to Oracle Security Alerts for patch notifications; assess feasibility of upgrading to patched versions. 30 days: Deploy compensating controls listed below; finalize upgrade plan for when vendor patch is released; establish continuous monitoring and alerting for exploitation attempts.

Oracle WebCenter Portal EUVD-2026-37340

| CVE-2026-46847 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Webcenter Portal Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable HTTPS endpoint with low complexity, requires a low-privileged authenticated portal account (PR:L), no user interaction, and full CIA takeover that extends beyond the portal (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Runtime Tools component) allows a low-privileged attacker with HTTPS network access to fully compromise the portal and, due to a scope change, impact additional downstream products. Oracle rates this 9.9 critical and the issue is described as easily exploitable; no public exploit identified at time of analysis and it is not currently listed in CISA KEV. The combination of low privilege requirement, network vector, and scope change makes any authenticated WebCenter user a credible threat for full takeover.

Technical ContextAI

Oracle WebCenter Portal is a Java-based enterprise portal platform within Oracle Fusion Middleware used to build collaboration and intranet sites, typically deployed on WebLogic Server and integrated with Oracle Identity, Content, and Database services. The vulnerable Runtime Tools component handles portal runtime management functionality reachable over HTTPS to authenticated users. No CWE was assigned by Oracle, but the CVSS scope change (S:C) combined with low-privileged network exploitation is consistent with an authorization or input-handling flaw in a privileged runtime endpoint that crosses trust boundaries into adjacent Fusion Middleware components (e.g., WebLogic, Content Server, or Identity stores). The CPE confirms the affected product as Oracle WebCenter Portal across all listed versions.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory, though a specific post-patch build number was not included in the input data and should be confirmed against the CPU patch matrix for 12.2.1.4.0 and 14.1.2.0.0. Until patching is complete, restrict HTTPS access to WebCenter Portal Runtime Tools endpoints to trusted networks via WAF or reverse-proxy ACLs, tighten the population of low-privileged portal accounts (disable self-registration and review guest/intern roles), and increase monitoring on WebLogic and Fusion Middleware audit logs for anomalous portal API calls and cross-component requests; these controls reduce exposure but do not eliminate risk for any authenticated user who still reaches the vulnerable component.