Oracle WebCenter Portal EUVD-2026-79379

No special conditions are required beyond network reachability of the WebCenter Portal HTTP listener: the CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating unauthenticated, low-complexity exploitation with no user interaction against the affected Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0. The practical limiting factor is exposure - the target port/service must be reachable by the attacker, so instances bound only to a trusted internal segment, or fronted by an authenticating proxy that rejects anonymous requests to the Runtime Tools paths, are materially harder to exploit. Exploitation is further limited in impact to read-only disclosure (C:H/I:N/A:N), and there is no evidence in the provided data of required authentication, elevated privilege, non-default configuration, or a specific platform prerequisite; the exact affected endpoint or feature name is not disclosed by the vendor, and the reported 'Authentication Bypass' tag is not backed by a published CWE.

The CVSS vector is the strongest signal here and it is genuinely severe: AV:N/AC:L/PR:N/UI:N means an unauthenticated, low-complexity, single-request attack requiring no user interaction - exactly the profile that scanners and opportunistic bots can automate at scale. Against that, the corroborating signals are thin: no EPSS score was supplied, no CISA KEV listing, and no public exploit code identified, so there is no evidence of active exploitation or widespread weaponization. Impact is confined to confidentiality (C:H, I:N, A:N), meaning data disclosure of all portal-accessible content rather than host compromise, but for a portal that aggregates HR, finance, or customer content that disclosure can be business-critical. Note a minor inconsistency to verify: the input Tags label this an 'Authentication Bypass' while no CWE is provided and the vendor description speaks only of 'unauthorized access to critical data' - the two are compatible, but the precise mechanism is not vendor-confirmed. Overall this is a real patching priority for any reachable WebCenter Portal instance, driven by ease of exploitation rather than by observed attacks; the absence of KEV/EPSS data should be treated as missing intelligence, not as evidence of low risk.

An attacker with network reach to the portal's HTTP listener sends a crafted request directly to a Runtime Tools endpoint, deliberately omitting any session or credentials. Because the request path is not properly authorized (PR:N, AC:L, UI:N), the server returns portal data that should only be visible to authenticated users, allowing the attacker to enumerate pages, documents, and other portal-accessible content. A simple script can iterate that endpoint across many hosts, so any exposed and unpatched instance is at risk even without a published exploit.