CVE-2026-83045 is a vulnerability in Oracle WebCenter Portal's Runtime Tools component affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 score of 8.5 with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 security fixes across multiple products.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some Oracle WebCenter Portal accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend beyond Oracle WebCenter Portal to additional products. The CVSS score of 8.5 reflects a high severity vulnerability.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Remaining on actively-supported versions and timely patching are critical, as Oracle reports ongoing attempts to exploit vulnerabilities for which patches exist. No alternative mitigations or workarounds are specified in the advisory.