EUVD-2026-79313
GHSA-5rwx-77vx-7g5p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable server-side flaw needing only a valid low-privilege account (PR:L) with no interaction and total impact on the Portal.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged authenticated attacker with HTTP network access to fully compromise the Portal through the Composer component, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation requires only a valid low-privilege account and a reachable HTTP interface - no user interaction and no elevated privileges - making the barrier to abuse relatively low for anyone with any Portal login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the Oracle WebCenter Portal HTTP interface hosting the Composer component, and (2) a valid but low-privileged authenticated account on the Portal - CVSS PR:L confirms authentication is mandatory, so this is not an unauthenticated flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack that requires only a low-privileged account and produces total compromise - a high but not critical score, correctly discounted from 9.8 only by the authentication prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's fix from the Critical Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html - patch status is 'Patch available per vendor advisory'; the exact patched build numbers are not present in the supplied data and must be read from that advisory before scheduling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today