The flaw resides in the Composer component of Oracle WebCenter Portal and can be triggered by an unauthenticated attacker through the HTTP interface. Successful exploitation requires a user other than the attacker to interact with a malicious payload, after which the attacker can take full control of the portal, compromising confidentiality, integrity, and availability. The weakness reflects improper authorization and input handling, a type of flaw that can lead to privilege escalation and data exposure.

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected in the Oracle Security Alert CSPUSEP2026. No other versions are reported vulnerable.

With a CVSS v3.1 base score of 9.6, the vulnerability is classified as critical, yet the EPSS score of < 1 % indicates a low likelihood of exploitation in the near term. The vulnerability is not included in CISA’s KEV catalog, but its potential to enable full portal takeover gives it a high risk profile. Attackers would need network access to the portal’s public HTTP endpoint and a victim click or interaction with the crafted payload to succeed.