Oracle WebCenter Portal EUVD-2026-37454

The attacker must hold valid credentials for any low-privileged role on Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 (CVSS PR:L) and be able to reach the Composer component over HTTP/HTTPS; no user interaction by another victim is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to deployments where the Composer runtime editing component is enabled (the default in standard WebCenter Portal installations) and where the targeted network path to the portal is exposed to the attacker - internet-facing portals with broad authenticated user bases, self-registration, or federated SSO are most exposed, while portals restricted to a small trusted user set on an internal network are materially harder to reach. No platform-specific or non-default configuration toggle is called out by Oracle beyond the presence of Composer itself.

This is a genuine high priority issue rather than an inflated CVSS number: the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means any authenticated portal user, even a low-privileged content contributor, can pivot over the network with low complexity to take over the portal and impact adjacent Fusion Middleware components via the scope change. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV at time of analysis, so there is currently no public exploit identified and no confirmed mass exploitation; however, Oracle Composer flaws have historically attracted rapid weaponization once CPU details are dissected. The main mitigating signal is PR:L - exploitation is gated on having (or obtaining) a valid portal account, which limits opportunistic internet-wide attacks but does little to stop an insider, a phished user, or any deployment that allows self-registration or federated SSO from a broad user base.

An attacker phishes or compromises a low-privileged WebCenter Portal account - for example a content contributor - then sends crafted HTTP requests to the Composer component to inject a malicious task-flow or resource definition that is processed server-side. Because the flaw causes a scope change, the resulting code or data manipulation reaches beyond the portal into the underlying Fusion Middleware stack, giving the attacker takeover of the portal and a foothold to pivot into integrated WebLogic-hosted applications. No public exploit identified at time of analysis, but the low complexity and Oracle's own 'easily exploitable' wording make reliable weaponization plausible once the CPU is reverse-engineered.