Description
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data confidentiality compromise
Action: Apply patch
AI Analysis

Impact

Oracle WebCenter Portal’s Runtime Tools component contains a flaw that allows an unauthenticated attacker with network access via standard HTTP to read a subset of portal data without authorization. The vulnerability is classified as easily exploitable and results in limited confidentiality impact, consistent with a CVSS v3.1 score of 5.3. No integrity or availability effects are described.

Affected Systems

The vulnerability affects Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 as identified by the vendor and reflected in the known CPE entries.

Risk and Exploitability

The risk profile is moderate. The CVSS score indicates a low‑to‑moderate severity, the EPSS score is < 1% (approximately 0.00316), indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attacks can be launched over the network via HTTP without authentication, requiring only connectivity to the portal. The primary impact is unauthorized read access to a subset of protected data, exposing confidentiality.

Generated by OpenCVE AI on October 29, 2026 at 22:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any Oracle WebCenter Portal patch or upgrade that addresses the Runtime Tools flaw.
  • Limit HTTP exposure by placing the portal behind a firewall or restricting access to trusted networks.
  • Review and tighten portal permissions to enforce proper access controls and prevent unauthorized data visibility.

Generated by OpenCVE AI on October 29, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle WebCenter Portal

Thu, 29 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Read in Oracle WebCenter Portal
Weaknesses CWE-284

Thu, 29 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Read in Oracle WebCenter Portal
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle webcenter Portal
CPEs cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Portal
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Webcenter Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T17:44:41.120Z

Reserved: 2026-09-14T22:10:16.618Z

Link: CVE-2026-91248

cve-icon Vulnrichment

Updated: 2026-10-29T17:44:36.650Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:25.733

Modified: 2026-11-04T14:24:39.907

Link: CVE-2026-91248

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T23:00:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor