EUVD-2026-79307
GHSA-4737-wf8m-fpjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebCenter Portal over HTTP
-
DeliverySend crafted request to Portlet Services
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full portal control
-
ImpactExfiltrate data and alter/disrupt portal
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle WebCenter Portal (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0, specifically the Portlet Services component, per Oracle's 'easily exploitable' / PR:N / UI:N / AC:L characterization. The primary limiting factor is network reachability of the WebCenter Portal HTTP interface: instances behind a WAF, reverse proxy, or not exposed to attacker-controlled networks substantially reduce exposure. Exploitation is confined to the two listed supported versions; other/patched builds and the September 2026 CPU fix remove the condition. |
| Impact | This carries a legitimately high risk profile. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity exploitation with no user interaction and full compromise of confidentiality, integrity and availability - consistent with the description's 'easily exploitable... unauthenticated attacker... network access via HTTP... takeover'. The CWE-287 (Improper Authentication) classification aligns with a pre-auth takeover primitive in the Portlet Services component. However, several corroborating signals are ABSENT: no EPSS score is provided, there is no CISA KEV listing, and no public POC is identified. No SSVC decision values are supplied. Oracle CPU advisories characteristically provide zero technical detail (no endpoint, parameter, or mechanism), so the 9.8 rests entirely on vendor self-scoring and cannot be independently verified. The rating is nonetheless plausible and well-calibrated for a pre-auth RCE-class flaw in an enterprise portal; historically Oracle Fusion Middleware pre-auth flaws (e.g., the Oracle Access Manager CVE-2021-35587) have later reached KEV. Treat as a genuine patch-now priority for exposed WebCenter Portal instances despite the absence of exploitation telemetry - the missing EPSS/KEV/POC signals reflect newness of the September 2026 CPU, not low risk. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach an internet- or intranet-exposed Oracle WebCenter Portal sends crafted HTTP request(s) to the Portlet Services component, abusing an improper-authentication flaw to bypass access controls and gain full control of the portal. Because CVSS marks PR:N/UI:N/AC:L, no credentials, victim interaction, or unusual conditions are required. No public exploit code has been identified at time of analysis, and Oracle's advisory provides no technical specifics. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 lets unauthenticated remote attackers reach protected functionality over HTTP and, on success, take over the application (CVSS 3.1 base score 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw maps to CWE-287 (Improper Authentication), meaning the portal's Portlet Services layer fails to properly validate that a request originates from an authenticated session. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the main exposure driver is network reachability of the WebCenter Portal HTTP interface, so internet-facing or broadly reachable instances behind no WAF or proxy carry the highest risk. Oracle addresses it in the September 2026 Critical Patch Update.
RemediationAI
Apply the Oracle September 2026 Critical Patch Update, which contains the fix for this issue, following the advisory at https://www.oracle.com/security-alerts/cspusep2026.html; Oracle CPUs are cumulative and typically require application downtime and a patch-set-compatible WebLogic/Fusion Middleware baseline, so plan a maintenance window and validate in a staging environment first. This is the only complete fix - there is no documented configuration flag that disables the vulnerable authentication path. Until patching is complete, reduce exposure by removing WebCenter Portal HTTP access from untrusted networks (internet-facing deployments should be placed behind a reverse proxy or WAF and restricted to known client ranges), which is effective but will break legitimate external or partner access and requires an accurate inventory of consumers. Where Portlet Services is not required, disabling or blocking that component's endpoints at the proxy layer narrows the attack surface, at the cost of losing portal functionality. Additionally, monitor web and WCM/WebCenter logs for anomalous unauthenticated requests to Portlet Services URIs, since detection is the fallback when prevention is not yet in place; note that per Oracle's PR:N/UI:N/AC:L characterization there is no privilege or interaction prerequisite, so detection cannot rely on suspicious authentication failures. No vendor patch version number beyond the CPU is specified in the available data, and no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-287 (Improper Authentication) describes a class of defects in which software does not correctly verify a claimed identity or permits access to protected resources without establishing one. Here the affected surface is the Portlet Services component of Oracle WebCenter Portal, part of Oracle Fusion Middleware, which exposes portlet consumption and rendering functionality over HTTP. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no special preconditions beyond reaching the service over the network - Oracle classifies it as 'easily exploitable.' The scope is unchanged (S:U) but all three impact metrics are High, consistent with an attacker gaining the portal's own privilege context and thereby reading, modifying, or disrupting portal content and configuration. This is a supported-version issue confined to 12.2.1.4.0 and 14.1.2.0.0, as recorded by EUVD (EUVD-2026-79307); patched builds and the September 2026 CPU remove the condition. The report originates from Oracle's own security team (secalert_us@oracle.com), the typical provenance for Critical Patch Update advisories.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable pre-auth network HTTP takeover with full C/I/A impact; retaining AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H, though no independent technical detail confirms it.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal instances running versions 12.2.1.4.0 and 14.1.2.0.0 are exposed to an unauthenticated remote authentication bypass in the Portlet Services component that can surrender full control of the portal application to anyone able to reach its HTTP interface. Because the flaw requires no credentials and no patch is currently available, every internet-facing or broadly reachable deployment represents an immediate, high-consequence exposure to the organization's internal collaboration, content, and application services. Leadership should treat this as a priority exposure-reduction effort owned jointly by the portal platform team and network security, not as a routine patch-cycle item.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or tightly restrict network reachability of the WebCenter Portal HTTP interface, especially the Portlet Services layer, so it is not internet-facing; enforce authentication and access control at a WAF, reverse proxy, or upstream gateway in front of the application; segment affected instances from sensitive internal networks; and monitor portal, proxy, and WAF logs for unauthorized or anomalous Portlet Services requests. Apply Oracle's September 2026 Critical Patch Update as soon as it is available for versions 12.2.1.4.0 and 14.1.2.0.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB