CVE-2026-73953 in WebCenter Portal
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Portlet Services component of Oracle WebCenter Portal, a key element of the Oracle Fusion Middleware suite used for building and managing enterprise portal applications. This security flaw affects specific supported versions, namely 12.2.1.4.0 and 14.1.2.0.0, indicating that even currently maintained software releases are susceptible to this critical issue. The nature of the vulnerability is particularly severe because it allows for exploitation by an unauthenticated attacker who requires only network access via HTTP to initiate a successful attack vector. This lack of authentication requirement significantly lowers the barrier to entry for malicious actors, as no valid credentials or prior interaction with the system are necessary to trigger the exploit conditions.
From a technical perspective, the flaw enables complete compromise of the Oracle WebCenter Portal environment. The ability to achieve takeover implies that an attacker can execute arbitrary code, modify application logic, or manipulate data within the context of the portal service. This level of access effectively neutralizes existing security controls since the attacker operates with the privileges of the underlying process running the Portlet Services component. Such a scenario aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), and potentially CWE-502, Deserialization of Untrusted Data, depending on the specific mechanism by which the unauthenticated input is processed to achieve remote code execution or privilege escalation within the application layer.
The operational impact of this vulnerability is profound due to its high severity rating. With a CVSS 3.1 Base Score of 9.8, classified as Critical, the vulnerability poses an immediate and severe threat to confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires low complexity, involves no user interaction or privileges, and results in high impacts across all three security triad dimensions. In practical terms, this means an attacker can steal sensitive data stored within the portal, alter critical business processes managed by WebCenter Portal, or disrupt service availability entirely through denial-of-service conditions triggered during exploitation. This aligns with ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing commands on compromised systems and potentially T1078 Valid Accounts if the takeover leads to lateral movement using escalated privileges.
Mitigation strategies must prioritize immediate remediation given the ease of exploitation and high impact. The primary defense is applying the latest security patches provided by Oracle that address this specific flaw in Portlet Services for versions 12.2.1.4.0 and 14.1.2.0.0. Organizations should verify their deployment inventory to ensure these vulnerable versions are identified and updated without delay. In scenarios where patching is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to block suspicious HTTP requests that exhibit patterns associated with this exploitation vector. Additionally, restricting access to the Portlet Services endpoints by IP address or implementing strict authentication requirements at a reverse proxy layer before traffic reaches Oracle Fusion Middleware can provide temporary mitigation against unauthenticated attacks until permanent fixes are deployed.