EUVD-2026-79317
GHSA-2vp6-w498-hg23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing WebCenter Portal
-
DeliverySend crafted HTTP request to Portlet Services
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full portal control
-
ImpactCompromise confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an Oracle WebCenter Portal instance (versions 12.2.1.4.0 or 14.1.2.0.0) with the Portlet Services component reachable; per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special configuration are needed, so default internet-exposed deployments are directly at risk. The primary limiting factor is exposure: WebCenter Portal is typically deployed behind enterprise perimeters/reverse proxies rather than open to the internet, and only the two named Fusion Middleware releases are in scope. Oracle discloses no specific feature toggle or non-default setting as a prerequisite. |
| Impact | This is a high-priority vulnerability by every available static signal, though real-world exploitation signals are thin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remotely reachable, unauthenticated, low-complexity flaw requiring no user interaction and yielding full confidentiality, integrity, and availability compromise - Oracle's own 'takeover' language and the CWE-287 (Improper Authentication) mapping are internally consistent with this. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is currently no evidence of active exploitation or automation - meaning the risk is theoretical-but-severe rather than confirmed-in-the-wild. The dominant caveat is that this is an Oracle Critical Patch Update entry (September 2026 CPU, cspusep2026) with zero technical detail: no endpoint, parameter, request shape, or root cause is disclosed, so the 'easily exploitable / unauthenticated' claim rests entirely on Oracle's self-assessment and cannot be independently verified. Given Oracle Fusion Middleware's history of pre-auth deserialization/auth-bypass bugs becoming exploited after patch release (cf. prior WebLogic/OAM CVEs), a 9.8 pre-auth takeover in an internet-facing portal product should be treated as an urgent patch priority despite the absence of EPSS/KEV/POC signals. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access sends a crafted HTTP request to the Portlet Services component of an internet-reachable Oracle WebCenter Portal instance, exploiting the authentication weakness (CWE-287) to bypass access controls and gain full control of the portal. Because CVSS is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or special timing are required. No public exploit code is identified at time of analysis, but Oracle characterizes the flaw as 'easily exploitable.' |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers who can reach the Portlet Services component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 over HTTP can bypass authentication and achieve full takeover of the application, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is an improper-authentication defect (CWE-287) and, per the assessed vector, needs no credentials, no user interaction and no non-default configuration, so any instance with Portlet Services reachable is directly at risk. No public exploit code has been identified at time of analysis, and the principal real-world limiter is exposure, since WebCenter Portal is typically deployed behind an enterprise perimeter rather than openly on the internet; this is nevertheless a high-priority issue on every available static signal, with thin real-world exploitation evidence.
RemediationAI
Apply the Oracle fix for this CVE as published in the Oracle Critical Patch Update / Security Alert advisory at https://www.oracle.com/security-alerts/cspusep2026.html - no exact patched build number is specified in the available data, so treat the vendor advisory as the source of truth for the fixed versions of WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 and follow Oracle's standard CPU application procedure (including any required WebLogic/Fusion Middleware prerequisite patches). Until the update is deployed, treat the portal as unauthenticated-attackable and enforce network-layer compensating controls: restrict HTTP/HTTPS access to the WebCenter Portal Portlet Services endpoints to trusted networks, VPN, or an authenticating reverse proxy/WAF rather than exposing them to the internet (trade-off: legitimate remote and partner access must be re-routed, and a WAF is only a partial mitigation for an authentication bypass because it relies on request-pattern signatures). If Portlet Services, WSRP producer/consumer functionality, or remote portlet integration is not required, disable or undeploy those capabilities and remove their endpoints from the proxy configuration (trade-off: breaks federated/remote portlet content for portal users). Additionally, review portal and web-server access logs for unauthenticated requests to portlet-service URLs and for anomalous session or identity parameters, and monitor the CVE and vendor advisory for updates on exploitation status, since no public exploit code is currently identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Portal is a Java EE (Fusion Middleware) enterprise portal and composite-application platform that renders portlets and consumes/produces remote portlet content via standards such as JSR-286 and WSRP over HTTP. The vulnerable component is Portlet Services, the subsystem that authenticates and brokers portlet requests, and the root cause class is CWE-287 (Improper Authentication), meaning the service accepts a request as authenticated without properly verifying the caller's identity or session. Because the CVSS scope is unchanged (S:U) while all three impact metrics are High, the bypass does not cross a privilege boundary within a shared scope - compromise of the portal itself yields administrative control of the application and its data. Oracle's advisory does not disclose the precise bypass mechanism; based on the CWE classification, plausible failure modes are improper validation of portlet-service or WSRP request parameters, trust of client-supplied identity/session assertions, or a missing authentication check on a Portlet Services endpoint, but the exact defect is not confirmed from the available data. The affected CPE context is the two named Fusion Middleware releases only (12.2.1.4.0 and 14.1.2.0.0), as corroborated by the ENISA EUVD entry (EUVD-2026-79317).
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes unauthenticated network HTTP 'takeover' with no user interaction; full C/I/A compromise of a single system supports 9.8 as stated, though it rests on vendor self-assessment.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Portal deployments (versions 12.2.1.4.0 and 14.1.2.0.0) are vulnerable to a critical authentication bypass that allows unauthenticated remote attackers with network access to the Portlet Services component to achieve full application takeover. Although there is no public exploit identified at time of analysis and these systems are often placed behind perimeter defenses, the lack of a vendor-released patch means any exposure could result in complete compromise of confidentiality, integrity, and availability. Leadership should prioritize immediate exposure assessment and interim risk mitigation for these business-critical portal environments.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation to limit exposure of the Portlet Services component, deployment of a web application firewall with virtual patching, enforcement of authentication at an upstream reverse proxy, and enhanced monitoring for authentication bypass attempts. If Portlet Services is not essential, temporarily disable it until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB