CVE-2026-91245 in WebCenter Portal
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Runtime Tools component of Oracle WebCenter Portal, a key element of the Oracle Fusion Middleware suite. This security flaw affects specific supported versions, namely 12.2.1.4.0 and 14.1.2.0.0, indicating that even currently maintained software releases are susceptible to exploitation. The nature of this vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the integrity of the Oracle WebCenter Portal application environment. This classification highlights a critical weakness in how the runtime tools handle incoming requests or process data without requiring prior authentication credentials from the client side, thereby exposing the system to remote attacks over standard web protocols.
The operational impact of this vulnerability is significant due to its potential for unauthorized access to sensitive information. Successful exploitation can lead to complete access to all Oracle WebCenter Portal accessible data, which may include critical business documents, user profiles, and configuration settings stored within the portal infrastructure. The severity is quantified by a CVSS 3.1 Base Score of 6.5, primarily driven by high confidentiality impacts while integrity and availability remain unaffected in this specific vector. This score reflects a medium-severity risk that demands immediate attention to prevent data breaches. The attack complexity involves low requirements for the attacker but necessitates human interaction from a victim other than the initial attacker, suggesting social engineering or phishing vectors may be employed to trigger the exploit conditions within the application runtime environment.
From a technical perspective, this vulnerability aligns with common web application security flaws where input validation or session management mechanisms fail adequately in the Runtime Tools layer. The requirement for human interaction suggests that the exploitation might involve tricking an authenticated user into performing an action that triggers the vulnerable code path, such as clicking a malicious link or uploading a crafted file through the portal interface. This behavior is consistent with CWE-79, which covers Cross-site Scripting vulnerabilities, or potentially CWE-20 for improper input validation if the flaw involves malformed data processing within the runtime tools. The attack vector corresponds to ATT&CK technique T1566.001, specifically Phishing: Spearphishing Attachment, or T1566.002 for Spearphishing Link, depending on whether the human interaction is triggered by a link click or file download that exploits the runtime processing logic.
Mitigation strategies should focus on immediate patching to the latest available version of Oracle WebCenter Portal released after this vulnerability was disclosed, as vendor patches typically address these specific code-level flaws in the Runtime Tools component. In environments where patching cannot be implemented immediately due to operational constraints, network segmentation and strict access control lists can help restrict HTTP traffic to only authorized IP ranges, reducing the attack surface for unauthenticated attackers. Additionally, deploying a Web Application Firewall with rulesets tuned to detect anomalous request patterns associated with this specific vulnerability can provide an additional layer of defense. Security awareness training is also critical given the requirement for human interaction; users should be educated on recognizing suspicious links or files that could trigger exploitation within the portal environment. Regular security audits and penetration testing focused on web application logic flaws will help identify similar weaknesses in other components before they are exploited by malicious actors seeking to compromise confidential data stored within the Oracle Fusion Middleware ecosystem.