Oracle WebCenter Portal EUVD-2026-79378

Mandatory prerequisite: a valid, authenticated Oracle WebCenter Portal session with at least low privileges (CVSS PR:L) - the attack does not work against anonymous users. The target must be an affected release (12.2.1.4.0 or 14.1.2.0.0) with the Runtime Tools component reachable over HTTP from the attacker's vantage point (AV:N), and no user interaction is needed (UI:N). Limiting factors: exploitation is scoped to data and operations the targeted portal instance exposes through Runtime Tools (scope is Unchanged, S:U), availability is unaffected (A:N), and the attacker gains no privilege escalation beyond what the low-privileged account already reaches - an administrator who has disabled self-registration and enforces strong attribution on portal accounts meaningfully raises the cost, since stolen or provisioned credentials are the gate. No additional configuration option, protocol, or non-default deployment mode is stated as required in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a low-skill, low-complexity attack requiring only a valid low-privileged account and no user interaction - an important nuance, since the PR:L metric means this is not an unauthenticated pre-auth bug and therefore cannot be mass-exploited by internet-wide scanning alone. Confidentiality is the dominant impact (C:H), so the realistic damage is bulk disclosure of portal content, while integrity is partial (I:L) and availability is untouched. No EPSS score, POC reference, or CISA KEV entry was provided, so there is no evidence of exploitation at scale; the risk is best characterized as a high-priority insider-adjacent or post-credential-theft risk rather than an urgent internet-facing emergency - even a mid-sized municipal IT team in mielec should treat this as urgent primarily because any compromised or self-registered portal account becomes a data-exfiltration pivot. Note the sourcing conflict worth verifying with Oracle: the accompanying tag set labels this an "Authentication Bypass," yet the CVSS vector explicitly requires PR:L (authenticated) and the description explicitly says "low privileged attacker," which is inconsistent with a true authentication bypass; the authorization-bypass interpretation is better supported by the available data, but Oracle's advisory text should be checked to confirm whether an unauthenticated variant exists.

An attacker who already holds any low-privileged portal account - self-registered, phished, or purchased - authenticates normally and then sends crafted HTTP requests to the Runtime Tools endpoints, manipulating request parameters to reach content objects their role should never expose. Because AC:L and UI:N, the whole sequence is scriptable and can be iterated to harvest the portal's critical data at scale, with limited unauthorized updates or deletions along the way. No public exploit code was reported in the supplied data, and no per-request authentication bypass is required.