Oracle WebCenter Portal EUVD-2026-46926

Exploitation requires the attacker to already hold a valid low-privileged account on the target Oracle WebCenter Portal instance (CVSS PR:L) plus network HTTP access to the Runtime Tools component; no user interaction and no high privileges are needed. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are named as affected. The limiting factors that reduce real-world risk are the authentication prerequisite (a foothold account is required, so this is not anonymous exploitation) and reachability of the Runtime Tools HTTP endpoint - deployments that isolate the portal behind VPN or restrict Runtime Tools access raise the bar. Oracle discloses no specific non-default configuration toggle, so exploitation should be assumed possible against standard deployments of the affected versions.

This is a genuine high priority, not merely a high-CVSS artifact. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes network-reachable, low-complexity exploitation needing only low privileges and no user interaction, with a scope change and high confidentiality and integrity impact, yielding 9.6. The scope change is the key amplifier: Oracle explicitly states attacks 'may significantly impact additional products,' extending blast radius past the portal. Availability is unaffected (A:N), so this is a data-theft and data-tampering risk, not denial of service. Countervailing signals: no EPSS score was provided, no proof-of-concept is known, and it is absent from CISA KEV, so there is no evidence of active or widespread exploitation yet - urgency derives from severity and ease of exploitation, not observed attacks. Note the apparent tension: it is tagged 'Authentication Bypass' yet the vector is PR:L, not PR:N - this indicates authority/privilege bypass after obtaining a low-privileged account rather than fully unauthenticated entry; a valid low-privilege session is still required, which limits anonymous internet-wide attacks.

An attacker holding or obtaining any low-privileged WebCenter Portal account (for example a basic self-service intranet user) sends crafted HTTP requests to the Runtime Tools component to bypass the intended authorization boundary. With no user interaction and low attack complexity, they read or alter all portal-accessible data and, via the scope change, reach into adjacent Fusion Middleware resources. No public proof-of-concept is currently known, so exploitation would require original research or reverse-engineering of the July 2026 patch.