Oracle WebCenter Portal EUVD-2026-61339

No special conditions beyond network reachability are required: the CVSS vector AV:N/AC:L/PR:N/UI:N/S:C confirms remote unauthenticated exploitation against default supported configurations of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0. No specific feature flag, non-default setting, or privileged configuration is stated as a prerequisite. The primary factor limiting exploitation is network reachability - if the portal is deployed exclusively on an isolated internal network with no external access, the exposure surface is reduced but not eliminated. Exploitation is constrained to confidentiality impact only; no write access, command execution, or service disruption capability is implied. The breadth of data accessible to a successful attacker depends on what data the specific portal deployment exposes, and the severity of the scope change depends on how many Fusion Middleware components are integrated with the affected portal instance.

The CVSS 3.1 base score of 8.6 accurately reflects a high-priority confidentiality risk driven by a network-accessible, zero-complexity, unauthenticated attack with scope change - a combination that structurally favors opportunistic or automated exploitation. No EPSS score is present in the available data, so exploitation probability cannot be quantified probabilistically; however, the AV:N/AC:L/PR:N attack profile means any attacker with HTTP reachability to the portal can attempt exploitation with minimal tooling. No CISA KEV listing has been identified, and no public exploit code is known at time of analysis, so active exploitation is unconfirmed. The scope change is the most operationally significant risk multiplier: organizations running tightly integrated Oracle Fusion Middleware stacks face data exposure across multiple systems, not just the portal layer. The confidentiality-only impact (I:N/A:N) limits the blast radius compared to a full RCE vulnerability, but complete read access to portal-accessible data - which in enterprise deployments often includes HR records, financial data, or identity stores - is severe in its own right. Given the low exploitation barrier, even a mid-sized municipal IT team in leszno that runs WebCenter Portal for citizen-facing services should treat this as urgent rather than deferring to a routine patch cycle. The primary uncertainty is the absence of EPSS and KEV data, which prevents a definitive real-world exploitation frequency assessment.

An unauthenticated remote attacker with HTTP access to the Oracle WebCenter Portal instance sends a crafted request to the Runtime Tools component, bypassing authentication controls and obtaining read access to critical portal data - such as user records, documents, or configuration artifacts accessible through the portal. Due to the scope change in the CVSS vector, the attacker may then leverage that access to reach integrated Oracle Fusion Middleware backend systems, exfiltrating data beyond the portal boundary. No public exploit code has been identified, but the low-complexity, credential-free attack profile means any attacker with network reachability and basic HTTP tooling could attempt this.