Oracle WebCenter Portal EUVD-2026-46925

Exploitation requires network HTTP access to the Oracle WebCenter Portal instance and a valid low-privilege account (PR:L) - the attacker must be authenticated at some minimal level, so this is not exploitable by a fully anonymous outsider. The vulnerable surface is the Runtime Tools component; no user interaction (UI:N) and no non-default configuration are cited as prerequisites, and attack complexity is low (AC:L). Limiting factors: the attacker needs at least low-tier portal credentials and the ability to reach the portal's HTTP interface, so deployments that restrict portal access to internal/trusted networks and tightly control account provisioning materially reduce realistic exposure. Affected only on supported versions 12.2.1.4.0 and 14.1.2.0.0.

The signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full C:H/I:H/A:H impact and Oracle's 'takeover' language - a serious combination. Oracle explicitly labels it 'easily exploitable.' However, no EPSS score, SSVC decision data, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified; absence of these signals is not evidence of low risk, merely missing data. The one tension worth noting: the assigned tags say 'Information Disclosure,' yet the CVSS and description indicate full integrity and availability impact plus takeover - the tag understates the actual severity, so defenders should treat this as a takeover-class issue, not merely disclosure. Net: a real priority given low barrier to exploitation, tempered by the fact that PR:L means the attacker still needs some valid low-privilege access.

An attacker who holds or phishes any low-privilege WebCenter Portal account authenticates and sends crafted HTTP requests to a Runtime Tools endpoint, abusing the flaw to escalate from limited access to full control of the portal, reading confidential content and modifying or disabling the application. Because attack complexity is low and no user interaction is needed, the action can be scripted once valid low-tier credentials are obtained. No public exploit code has been identified at time of analysis.