CVE-2026-73959
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Vulnerability in Oracle WebCenter Portal (Composer component). A low privileged attacker with network access via HTTP can compromise the portal. Easy to exploit, full impact on confidentiality, integrity, and availability.
Risk Assessment
Compromise of WebCenter Portal could lead to unauthorized data access and integrity violation of published content.
Recommendation
Apply patches from Oracle for supported versions. Restrict user privileges and monitor portal activity.
Other vulnerabilities in Oracle WebCenter Portal
See all- CVE-2014-4257High
Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.8.0 allows remote attackers to affect confidentiality via unknown vectors related to Portlet Services.
- CVE-2026-83064Critical
Vulnerability in Oracle WebCenter Portal (component: Runtime Tools) affects versions 12.2.1.4.0 and 14.1.2.0.0. A high privileged attacker with network access via HTTP can compromise Oracle WebCenter Portal, and attacks may impact additional products (scope change). CVSS 3.1 Base Score is 9.1.
- CVE-2026-83043Critical
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise Oracle WebCenter Portal, but the attack requires human interaction and may significantly impact additional products (scope change).
- CVE-2026-83040Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via SOAP can compromise Oracle WebCenter Portal, but requires human interaction.
- CVE-2026-83039Critical
Vulnerability in Oracle WebCenter Portal (Composer component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low privileged attacker with network access via HTTP can easily compromise Oracle WebCenter Portal.
- CVE-2026-73963Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73957Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit it, but human interaction is required; the attack may also impact additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.3.
- CVE-2026-73956Critical
Vulnerability in Oracle WebCenter Portal (Composer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73953Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73952Critical
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it, resulting in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.1.
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS