Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Manipulation via Remote Access
Action: Patch Immediately
AI Analysis

Impact

A flaw in Oracle WebCenter Portal’s portlet services enables unauthenticated attackers with network access via HTTP to compromise the portal. Successful exploitation permits attackers to create, delete, or modify access controls and to read or alter critical portal data, violating confidentiality and integrity. The vulnerability is classified as a high‑severity risk with a CVSS score of 9.1.

Affected Systems

Oracle Corporation’s Oracle WebCenter Portal, specifically versions 12.2.1.4.0 and 14.1.2.0.0, are affected. These versions are part of Oracle Fusion Middleware and are commonly deployed in enterprise portal environments.

Risk and Exploitability

The CVSS base score of 9.1 indicates significant impact, while the EPSS score of less than 1% suggests a low current exploitation probability. The attack vector is network‑based over HTTP with no authentication required, meaning an attacker can initiate the exploit from any location that can reach the portal. The vulnerability is not listed in CISA’s KEV catalog, but the combination of high impact and low but nonzero exploitation risk warrants immediate mitigation.

Generated by OpenCVE AI on September 17, 2026 at 05:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch that addresses CVE-2026-73952 to all affected Oracle WebCenter Portal installations.
  • Restrict external network access to the WebCenter Portal by limiting inbound HTTP traffic to a whitelist of trusted IP addresses or through a dedicated VPN, thereby reducing the attack surface while the patch is deployed.
  • Verify the portal’s authentication configuration to ensure that no default or insecure settings remain, and disable or harden any unused portlet services that could expose additional vectors for exploitation.

Generated by OpenCVE AI on September 17, 2026 at 05:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle WebCenter Portal Leading to Unauthorized Data Manipulation

Wed, 16 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:43.107Z

Reserved: 2026-08-13T18:41:45.893Z

Link: CVE-2026-73952

cve-icon Vulnrichment

Updated: 2026-09-15T22:47:38.282Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:46.347

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-73952

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:15:19Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function