Oracle WebCenter Portal EUVD-2026-46924

Exploitation requires network access to the WebCenter Portal HTTP interface and a valid low-privileged account (CVSS PR:L) on Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0, targeting the Runtime Tools component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are therefore the authentication requirement (some level of legitimate or stolen credentials must exist - it is not fully anonymous) and the affected-version constraint; the scope change (S:C) means a successful attack can impact resources beyond WebCenter Portal itself. Exact configuration prerequisites (e.g., whether specific Runtime Tools features must be enabled) are not disclosed in the Oracle advisory and cannot be confirmed from the available data.

The signals are largely consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) shows remote HTTP exploitation, low complexity, only low privileges required, no user interaction, and a scope-changing full compromise - Oracle explicitly calls it 'easily exploitable.' Countering this, exploitation still requires an authenticated low-privileged account (PR:L), which limits fully anonymous mass exploitation, and no EPSS score, POC, or KEV listing was supplied, so there is no evidence of active exploitation or automated weaponization yet. The vendor tag 'Information Disclosure' is narrower than the vector's full C/I/A takeover claim - this is a mild conflict; treat the CVSS 'takeover' language as authoritative for worst-case impact and the tag as an incomplete label. EPSS is absent (not low - simply not provided), so probability of exploitation cannot be quantified. Net: a real, near-top-severity issue that warrants prompt patching, tempered only by the authentication prerequisite and the current absence of public exploit code.

An attacker who has obtained any low-privileged WebCenter Portal account - for example a self-registered or compromised standard user - sends a crafted HTTP request to the Runtime Tools component. Because attack complexity is low and no user interaction is needed, the request escalates the session to full control of the portal and, via the scope change, reaches connected Fusion Middleware components, resulting in complete confidentiality, integrity, and availability compromise. No public exploit code was identified at time of analysis, so this scenario is derived from the CVSS vector rather than a released PoC.