Oracle WebCenter Portal EUVD-2026-61328

Exploitation requires network access via HTTP to an Oracle WebCenter Portal 14.1.2.0.0 instance and a valid low-privileged portal account (PR:L per CVSS vector). The 'Authentication Bypass' intelligence tag indicates the attacker must be authenticated but the Runtime Tools component fails to enforce authorization correctly for that credential tier, allowing access to data beyond their permitted scope. For cross-system scope-change impact to materialize, the portal must be integrated with additional Oracle Fusion Middleware components - standalone portal deployments without backend integrations limit secondary exposure. Exploitation is bounded by the requirement for at least a basic user credential; fully unauthenticated external attackers cannot directly trigger this flaw without first obtaining portal access through other means. No special portal features or non-default configurations are identified as prerequisites beyond the standard Runtime Tools component being active.

The CVSS 7.7 score is driven by a strong vector - AV:N/AC:L/PR:L/UI:N/S:C/C:H - confirming network-exploitable, low-complexity, scope-changing, confidentiality-critical impact. Oracle's own advisory language ('easily exploitable') reinforces the low-barrier nature of this flaw. No EPSS score was present in the intelligence data, limiting probabilistic exploitation forecasting; this is a gap in the risk picture. The absence of a CISA KEV listing and no reported POC code suggests exploitation remains theoretical at time of writing, but the low attack complexity is a meaningful accelerant - the barrier from discovery to weaponization is low. The scope change is the most organizationally significant risk amplifier: enterprises running WebCenter Portal integrated with Fusion Middleware components face exposure across a wider data surface than the portal alone. The confidentiality-only impact profile (I:N, A:N) indicates unauthorized data read rather than destructive or availability impact, but Oracle notes this can result in 'complete access to all Oracle WebCenter Portal accessible data,' which constitutes a severe business risk for portals handling sensitive enterprise content.

An attacker holding a basic portal user account sends a crafted HTTP request to the Runtime Tools component of Oracle WebCenter Portal 14.1.2.0.0, exploiting the authorization bypass to read confidential data well beyond their permitted scope - including content from connected Oracle Fusion Middleware backend systems. Oracle describes the flaw as 'easily exploitable,' and the low attack complexity (AC:L) suggests that once the bypass endpoint or parameter is identified, triggering the unauthorized data access requires minimal technical sophistication. No public POC has been identified at time of analysis.