Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification and partial denial of service
Action: Assess Impact
AI Analysis

Impact

A vulnerability in Oracle WebCenter Portal allows an unauthenticated attacker who can reach the system over HTTP to cause integrity and availability problems. Exploitation requires user interaction from a person other than the attacker, but once engaged the attacker can create, delete or modify critical data and trigger a partial denial of service. The impact is focused on data integrity and availability, reflected in a CVSS v3.1 base score of 5.9 with no impact on confidentiality.

Affected Systems

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These releases are part of Oracle Fusion Middleware and support the Runtime Tools component.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate severity. The EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog, implying exploitation is unlikely. Because the attack requires human interaction in addition to network access, the risk is limited to scenarios where an attacker can coerce or trick an authorized user to assist.

Generated by OpenCVE AI on October 29, 2026 at 05:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict HTTP access to the portal by placing it behind a firewall or VPN so only trusted networks can reach it
  • If feasible isolate the portal behind an authentication proxy that validates all requests before they reach the application
  • Apply any new security patches and updates released by Oracle for the affected WebCenter Portal versions
  • Monitor web access logs for unusual activity such as repeated failed interactions that may indicate attempt to induce user interaction
  • Limit the functionality exposed over public HTTP interfaces where possible to reduce the attack surface

Generated by OpenCVE AI on October 29, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Allows Data Modification and Partial Denial of Service in Oracle WebCenter Portal

Thu, 29 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Allowing Data Modification and Partial Denial in Oracle WebCenter Portal
Weaknesses CWE-284
CWE-749

Thu, 29 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Allowing Data Modification and Partial Denial in Oracle WebCenter Portal
Weaknesses CWE-284
CWE-749

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T01:52:01.597Z

Reserved: 2026-09-14T22:10:16.618Z

Link: CVE-2026-91247

cve-icon Vulnrichment

Updated: 2026-10-29T01:47:39.509Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:25.620

Modified: 2026-11-04T14:25:12.093

Link: CVE-2026-91247

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T05:30:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption