A flaw in the Runtime Tools component of Oracle WebCenter Portal allows an attacker with low privileges to access the portal over HTTP and gain full control of the application. The vulnerability enables compromise of confidentiality, integrity, and availability, giving the attacker the ability to modify settings, access sensitive data, or disrupt service. The attack appears to be feasible through the network path exposed by the portal’s HTTP interface, and the exploitation requires only basic network access and no additional privileges beyond those of a local or remote very low privileged user.

Oracle WebCenter Portal from Oracle Corporation is affected. Specifically, the publicly supported versions 12.2.1.4.0 and 14.1.2.0.0 contain the flaw. The issue resides in the Runtime Tools component of the Fusion Middleware suite. No other Oracle Fusion Middleware products are listed as impacted.

The CVSS 3.1 base score of 9.9 indicates critical severity, with network access, low attack complexity, and low privilege requirements. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not included in the CISA KEV catalog. Nevertheless, because the flaw permits complete takeover of the portal and can affect additional products, the overall risk to an organization that exposes the portal to the internet is high.