Oracle WebCenter Portal EUVD-2026-37340

Attacker must have network reachability to the Oracle WebCenter Portal HTTPS interface and any valid low-privileged portal account (PR:L), with no user interaction required (UI:N) and low attack complexity (AC:L), against Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 running the Runtime Tools component. Limiting factors: the portal must be reachable to the attacker (commonly internal/VPN-only in many enterprise deployments), the attacker must hold or obtain credentials for at least one portal account, and unpatched 12.2.1.4.0 / 14.1.2.0.0 must be deployed - older or already-patched Fusion Middleware versions are out of scope.

All signals point to high real-world risk: CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means a low-privileged remote attacker can trigger full CIA impact on the portal and pivot into adjacent products with no user interaction and low attack complexity. Oracle itself characterizes the flaw as 'easily exploitable,' which is unusual language and elevates concern. Counterbalancing signals: EPSS score and SSVC decision data were not provided, no public PoC has been identified, and the issue is not in CISA KEV, suggesting exploitation is plausible but not yet confirmed in the wild. CWE is N/A and no technical write-up exists beyond Oracle's CPU advisory, so the exact bug class is unconfirmed - defenders should treat this as a likely priority patch for any internet- or intranet-exposed WebCenter deployment where users (including low-trust ones) can authenticate.

An attacker obtains or creates any low-privileged WebCenter Portal account - for example via self-service registration, a phished employee credential, or a compromised contractor login - then sends crafted HTTPS requests to a Runtime Tools endpoint to escalate to full portal takeover. Because the CVSS scope is changed, the attacker then leverages the compromised portal's trust relationships to read or modify data in adjacent Fusion Middleware components (content repositories, identity stores, integrated databases). No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording indicates a low-effort path once details are reverse-engineered from the patch.