Oracle WebCenter Portal EUVD-2026-61410

The affected instance must be an Oracle WebCenter Portal deployment at version 12.2.1.4.0 or 14.1.2.0.0 with the Portlet Services component reachable by the attacker over HTTP. No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' rating. The primary limiting factor is network reachability: exploitation requires the attacker to have an HTTP path to the portal, so instances segmented behind a VPN, internal-only network, or IP allow-list are far less exposed than internet-facing deployments. Exploitation is confined to WebCenter Portal itself (Scope: Unchanged), and only confidentiality and availability are at risk - there is no integrity/modification impact.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, which aligns with Oracle's own 'easily exploitable' language and 'Authentication Bypass' tag. The 9.1 severity is driven by high confidentiality and high availability impact with no integrity impact (C:H/I:N/A:H). Mitigating the urgency somewhat, there is no EPSS score, no SSVC decision data, and no POC or CISA KEV entry provided, so widespread automated exploitation is not yet evidenced - the current signal is severity and ease-of-attack, not confirmed in-the-wild activity. Because WebCenter Portal instances are frequently internet- or intranet-facing and hold sensitive corporate content, any organization running the affected versions - from large enterprises down to a mid-sized municipal or departmental IT team - should treat patching as urgent and not wait for exploitation to be observed. Note the conflict to watch: absence of EPSS/KEV data is a lack of evidence, not evidence of low real-world risk given the unauthenticated network vector.

An unauthenticated attacker who can reach the WebCenter Portal over HTTP sends a crafted request to the Portlet Services component, bypassing authentication to retrieve sensitive portal-accessible data. The same request class can be abused to drive the portal into a hang or repeatable crash, taking the service offline. No public exploit code is identified at this time, but the low attack complexity and lack of required privileges or user interaction make weaponization straightforward if details emerge.