Oracle WebCenter Portal EUVD-2026-79371

Requires network access over HTTP to the Composer component of Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0; no authentication is required (PR:N). The critical limiting factor is mandatory human interaction from a person other than the attacker (UI:R) - a legitimate user must perform an action (e.g., follow a crafted link or process attacker-supplied content in Composer) for the attack to succeed. Exploitation causes a scope change, so impact can extend beyond the portal into integrated products. Attack complexity is low (AC:L), making the technical trigger easy once a victim interacts, but the user-interaction requirement is what distinguishes this from the no-interaction (UI:N) siblings in the same CPU.

This is a genuinely high-priority vulnerability, though the raw 9.6 CVSS slightly overstates practical exploitability versus a pure pre-auth RCE. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated flaw that yields full compromise (C:H/I:H/A:H) with a scope change into adjacent products - but the UI:R metric is the decisive limiter: exploitation requires a human other than the attacker to take an action, which drops it below the 10.0 no-interaction WebLogic pre-auth flaws in the same Oracle September 2026 CPU (cf. sibling twin CVE-2026-83039, same Composer component, PR:L/UI:N, scored 9.9). No EPSS score, no SSVC decision data, no CISA KEV listing, and no public PoC are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' Oracle's CPU advisory (cspusep2026) provides zero technical detail - no endpoint, parameter, or exploit mechanics - so this remains a vendor-attested severity rather than an independently verified one. Net: treat as a top-tier patch priority for any WebCenter Portal deployment given the full-triad impact and scope change, but recognize the UI:R requirement and absence of exploitation signals mean it is not yet a confirmed mass-exploitation event. The 'Information Disclosure' tag conflicts with the full C:H/I:H/A:H triad and understates the flaw.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the Composer component of an internet- or intranet-reachable Oracle WebCenter Portal instance, then lures a legitimate user (e.g., a portal author or administrator) into triggering it, satisfying the required human interaction. Because the vulnerability carries a scope change and full CIA impact, successful exploitation results in takeover of the portal and may pivot into additional integrated Fusion Middleware products. No public exploit code is identified at time of analysis, and Oracle's advisory provides no technical specifics.