Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle WebCenter Portal’s portlet services allows an unauthenticated user to exploit a weak access control mechanism. Because the vulnerability is reachable over HTTP, an attacker can gain full control of the portal, leading to complete loss of confidentiality, integrity and availability. The flaw is classified under CWE-284 and is reflected in a high CVSS 3.1 base score of 8.1.

Affected Systems

Oracle Corporation’s WebCenter Portal is affected, specifically the 12.2.1.4.0 and 14.1.2.0.0 releases. No other products or versions are listed as impacted.

Risk and Exploitability

The main risk level is moderate to high: the base score indicates severe impact, while the EPSS score of less than 1% suggests current exploitation potential is low. However, the vulnerability is relatively difficult to exploit yet offers complete takeover once successful. The attack vector is inferred to be network access via HTTP, typically from any net‑enabled client without needing prior authentication. The vulnerability is not yet listed in CISA KEV, but its impact warrants immediate attention.

Generated by OpenCVE AI on September 17, 2026 at 05:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebCenter Portal patch or upgrade to a version that removes the access‑control flaw
  • Restrict inbound HTTP traffic to the portal to trusted networks or VPN endpoints to limit exposure
  • Enforce authentication and proper authorization on portlet services to prevent unauthorized access
  • Monitor portal logs for suspicious activity and configure alerts for repeated access attempts

Generated by OpenCVE AI on September 17, 2026 at 05:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Compromise of Oracle WebCenter Portal

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:29:45.618Z

Reserved: 2026-08-13T18:41:45.893Z

Link: CVE-2026-73951

cve-icon Vulnrichment

Updated: 2026-09-16T14:54:10.187Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:46.240

Modified: 2026-09-16T19:40:00.317

Link: CVE-2026-73951

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:15:19Z

Weaknesses