CVE-2026-61208
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle WebCenter Portal (component: Runtime Tools) affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker can gain unauthorized access to critical data, modify some data, and cause partial denial of service. CVSS 7.6.
Risk Assessment
Risk of data confidentiality breach, unauthorized modifications, and partial unavailability of the portal, potentially disrupting operations.
Recommendation
Apply Oracle patches. Restrict user privileges and monitor access to sensitive data.
Other vulnerabilities in Oracle WebCenter Portal
See all- CVE-2014-4257High
Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.8.0 allows remote attackers to affect confidentiality via unknown vectors related to Portlet Services.
- CVE-2026-83064Critical
Vulnerability in Oracle WebCenter Portal (component: Runtime Tools) affects versions 12.2.1.4.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle WebCenter Portal, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83043Critical
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Portal, but the attack requires human interaction and may significantly impact additional products (scope change).
- CVE-2026-83040Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via SOAP can compromise Oracle WebCenter Portal, but requires human interaction.
- CVE-2026-83039Critical
Vulnerability in Oracle WebCenter Portal (Composer component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low privileged attacker with network access via HTTP can easily compromise Oracle WebCenter Portal.
- CVE-2026-73963Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73957Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit it, but human interaction is required; the attack may also impact additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.3.
- CVE-2026-73956Critical
Vulnerability in Oracle WebCenter Portal (Composer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73953Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73952Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it, resulting in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.1.
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS