An unauthenticated, network‑based vulnerability in Oracle WebCenter Portal allows attackers to perform unauthorized read, update, or delete operations on certain data. The flaw requires human interaction from a user other than the attacker, limiting the automatic exploitation window, but any successful exploitation can compromise the confidentiality and integrity of data exposed by the portal. The vulnerability may also affect other associated products, potentially enabling broader impact across the same environment.

Affected systems are Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware’s Runtime Tools component.

The vulnerability carries a CVSS 3.1 base score of 6.1, indicating moderate severity. The risk is mitigated by the need for human interaction and the lack of availability impact. The EPSS score is 0.00245 (<1%), indicating a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, indicating current exploitation likelihood remains uncertain. The likely attack vector is via normal HTTP traffic to the portal, making it accessible over the network to unauthenticated users who can trigger the unauthorized data operations.