CVE-2026-61229
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Vulnerability in Oracle WebCenter Portal (component: Runtime Tools). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, allows unauthenticated attacker to take over the portal.
Risk Assessment
Risk of complete takeover of the portal, potentially leading to compromise of confidentiality, integrity, and availability of data.
Recommendation
Apply patches from Oracle for Oracle WebCenter Portal. Restrict access to the HTTP service and implement additional network security measures.
Other vulnerabilities in Oracle WebCenter Portal
See all- CVE-2014-4257High
Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.8.0 allows remote attackers to affect confidentiality via unknown vectors related to Portlet Services.
- CVE-2026-83064Critical
Vulnerability in Oracle WebCenter Portal (component: Runtime Tools) affects versions 12.2.1.4.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle WebCenter Portal, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83043Critical
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Portal, but the attack requires human interaction and may significantly impact additional products (scope change).
- CVE-2026-83040Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via SOAP can compromise Oracle WebCenter Portal, but requires human interaction.
- CVE-2026-83039Critical
Vulnerability in Oracle WebCenter Portal (Composer component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low privileged attacker with network access via HTTP can easily compromise Oracle WebCenter Portal.
- CVE-2026-73963Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73957Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit it, but human interaction is required; the attack may also impact additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.3.
- CVE-2026-73956Critical
Vulnerability in Oracle WebCenter Portal (Composer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73953Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73952Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it, resulting in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.1.
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS