Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Manipulation via Remote Access
Action: Patch Immediately
AI Analysis

Impact

This vulnerability is an authentication bypass flaw (CWE-287) combined with a missing authentication weakness (CWE-306) in the portlet services of Oracle WebCenter Portal. An unauthenticated attacker who can reach the portal over HTTP can create, delete or modify data and control access settings, leading to full compromise of confidential and integrity‑sensitive portal content.

Affected Systems

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These releases are components of Oracle Fusion Middleware and are frequently deployed in enterprise portal deployments.

Risk and Exploitability

The CVSS base score of 9.1 indicates a high impact with confidentiality and integrity loss, while the EPSS score of less than 1% suggests that exploitation is currently rare but possible. The attack vector is purely network‑based via HTTP and requires no authentication, meaning any external host with connectivity to the portal can initiate the exploit. The vulnerability is not listed in CISA’s KEV catalog, but the combination of high impact and non‑zero exploitation probability warrants immediate attention.

Generated by OpenCVE AI on September 20, 2026 at 11:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle WebCenter Portal patch that addresses CVE-2026-73952 and eliminates the authentication bypass (CWE-287) in the portlet services.
  • Secure the portal configuration to mitigate missing authentication (CWE-306) by disabling default or insecure administrative interfaces and enforcing strong credential policies.
  • Restrict inbound HTTP traffic to trusted IP ranges or enforce VPN access to reduce the attack surface while the patch is applied.

Generated by OpenCVE AI on September 20, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle WebCenter Portal Leading to Unauthorized Data Manipulation

Thu, 17 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Vulnerability in Oracle WebCenter Portal Leading to Unauthorized Data Manipulation

Wed, 16 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:43.107Z

Reserved: 2026-08-13T18:41:45.893Z

Link: CVE-2026-73952

cve-icon Vulnrichment

Updated: 2026-09-15T22:47:38.282Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:46.347

Modified: 2026-09-22T19:50:46.520

Link: CVE-2026-73952

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T12:00:13Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function