EUVD-2026-79310
GHSA-3px6-rvxh-wvw2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebCenter Portal HTTP endpoint
-
DeliverySend crafted request to Composer component
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full portal control
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported default deployments of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0, specifically reaching the Composer component. Per the CVSS vector (PR:N/UI:N/AC:L) no credentials, victim interaction, or non-default configuration are needed. The primary limiting factor is network reachability of the WebCenter Portal HTTP interface: internet-exposed instances are directly at risk, while deployments restricted to internal networks or behind authenticating reverse proxies/WAFs are correspondingly harder to reach. Instances not on the two named versions are outside the stated affected scope. |
| Impact | All CVSS signals point to maximum severity: AV:N/AC:L/PR:N/UI:N means Oracle characterizes this as remotely and easily exploitable by an unauthenticated attacker over HTTP with no user interaction, and C:H/I:H/A:H reflects Oracle's stated outcome of full 'takeover of Oracle WebCenter Portal.' The 9.8 base score is internally consistent and, for a genuine pre-auth authentication-bypass (CWE-287) leading to product takeover, well-calibrated rather than inflated. However, the countervailing exploitation-maturity signals are all absent or unknown: there is no CISA KEV listing, no public proof-of-concept, and no EPSS probability supplied in the input. As is typical for Oracle Critical Patch Update entries, the advisory (cspusep2026) provides zero technical detail - no vulnerable endpoint, parameter, or root-cause mechanism - so the exact attack surface within the Composer component cannot be independently verified. Net assessment: this is a real, high-priority patching target given the pre-auth-RCE-equivalent impact class and Oracle's 'easily exploitable' language, but there is currently no evidence of active or automated exploitation. Prioritize patching on the severity and product-criticality basis, not on an observed-exploitation basis, and note that the low public-signal profile suggests no widespread weaponization yet. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to the WebCenter Portal's HTTP(S) interface sends a crafted request to the Composer component that bypasses authentication and yields full control of the portal. No credentials, user interaction, or non-default configuration are required per the CVSS vector. No public exploit code has been identified at time of analysis, so exploitation would currently require independent vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can be taken over by an unauthenticated remote attacker who reaches the Composer component over HTTP, because the component fails to properly enforce authentication (CWE-287). Oracle scores this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required - only network reachability of the WebCenter Portal HTTP interface, with the stated outcome being full takeover of the portal. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is driven by exposure: internet-facing instances are directly at risk, while deployments confined to internal networks or sitting behind an authenticating reverse proxy or WAF are materially harder to reach. This is assessed as well-calibrated maximum severity rather than an inflated score, since an unauthenticated authentication bypass leading to product takeover justifies the C:H/I:H/A:H impact set.
RemediationAI
The primary remediation is to apply the Oracle Critical Patch Update referenced in the vendor advisory (https://www.oracle.com/security-alerts/cspusep2026.html) to any instance running WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 - patch available per vendor advisory, though the supplied data does not enumerate a specific patched build number, so confirm the exact fix version against the CPU document before validating closure. Where patching cannot be completed immediately, the most effective compensating control is to remove the Composer HTTP surface from untrusted reach: restrict the WebCenter Portal listener to trusted internal segments or place it behind an authenticating reverse proxy or WAF that rejects unauthenticated requests to Composer paths, accepting the trade-off that legitimate remote and extranet users will need VPN or SSO-mediated access and that proxy rules must be maintained as URL layouts change. Disabling or undeploying the Composer application entirely if it is not in active use is the strongest interim measure, at the cost of losing design-time portal editing until it is restored. Network ACLs and firewall rules limiting inbound HTTP/HTTPS to known management hosts are useful but only partial, since any permitted client can still reach the vulnerable endpoint. Note that because the flaw is an authentication bypass (CWE-287), the usual credential-hardening and MFA steps do not mitigate it - the request never legitimately authenticates in the first place - so exposure reduction and patching should be prioritized over identity controls. Verify remediation by re-checking build versions and confirming the Composer endpoints no longer respond to unauthenticated requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle Fusion Middleware's WebCenter Portal, an enterprise portal platform used to build and present intranet/extranet workspaces, and the vulnerable code sits in its Composer component - the design-time/administrative layer used to assemble pages, templates, and portal artifacts. The root cause class, CWE-287 (Improper Authentication), indicates the component accepts requests without correctly validating the caller's identity or session, rather than mishandling data once inside an authenticated context; this is an authentication control failure at the HTTP entry point, not an injection or memory-safety defect. Consequently the exploit path is a network-reachable HTTP request to the Composer surface, which per the assessed vector (AV:N/AC:L/PR:N/UI:N) needs no prior session, no victim interaction, and no non-default configuration. The EUVD record (EUVD-2026-79310) confirms the same two affected builds, 12.2.1.4.0 and 14.1.2.0.0, and the vendor advisory for this release cycle is Oracle's Critical Patch Update at the security-alerts location. Because the defect is an authentication bypass rather than a privilege-escalation-after-login issue, any compensating control that terminates or filters unauthenticated HTTP traffic before it reaches the Composer endpoints directly reduces exploitability.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes an easily exploitable unauthenticated network HTTP authentication bypass yielding full product takeover, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a maximum-severity authentication bypass in the Composer component that would allow anyone who can reach the portal over the network to seize full control of the platform without credentials. Any internet-facing or broadly reachable deployment of these versions should be treated as a direct organizational exposure, affecting the teams, partners, and customers who depend on the portal and the sensitive content and integrations it hosts. Because Oracle has not released a patch, risk must be managed through exposure reduction and monitoring rather than remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet exposure and restrict network reachability of the WebCenter Portal HTTP interface to trusted sources; place the portal behind an authenticating reverse proxy, SSO gateway, or WAF that enforces authentication before requests reach the Composer component; block or deny direct access to Composer endpoints at the perimeter; enable detailed logging and alerting on Composer activity and unexpected administrative or session creation; monitor vendor advisory channels for a patched release and apply it as soon as it is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB