CVE-2026-91248 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some data accessible through the portal. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with confidentiality impact only. Oracle has published a Critical Patch Update advisory that includes patches addressing this and many other vulnerabilities.
CVE-2026-91247 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the portal. Exploitation is difficult and requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data and can cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity level.
CVE-2026-91246 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to compromise the portal. Exploitation requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. The vulnerability also has a scope change, potentially impacting additional Oracle products. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities.
CVE-2026-91245 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity focused on confidentiality impact.
A critical vulnerability (CVE-2026-83043) exists in Oracle WebCenter Portal (component: Composer) versions 12.2.1.4.0 and 14.1.2.0.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product, requiring user interaction from a third party. Successful exploitation can lead to full takeover of Oracle WebCenter Portal and may impact additional products. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality, integrity, and availability impacts. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2026-83041 is a vulnerability in Oracle WebCenter Portal (component: Portlet Services) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, potentially leading to unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with significant confidentiality impact. Oracle has released security patches addressing this issue in their September 2026 Critical Security Patch Update.
A critical vulnerability exists in Oracle WebCenter Portal (component: Portlet Services) affecting versions 12.2.1.4.0 and 14.1.2.0.0. This vulnerability allows an unauthenticated attacker with network access via HTTP to potentially compromise the system, requiring user interaction from a third party. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Portal. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impacts.
A vulnerability in Oracle WebCenter Portal (component: Portlet Services) affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle WebCenter Portal. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, impacting confidentiality, integrity, and availability. Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update.
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle WebCenter Portal executes to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83052 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with network access via HTTP to compromise the portal, potentially gaining unauthorized access to critical data and the ability to update, insert, or delete some data. The vulnerability impacts confidentiality and integrity but not availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products.
CVE-2026-83051 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle WebCenter Portal. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges.
CVE-2026-83050 is a vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The attacker can also perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity.
CVE-2026-83049 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, potentially gaining unauthorized access to critical data and the ability to update, insert, or delete some data. The vulnerability impacts confidentiality and integrity but does not affect availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products.
CVE-2026-83048 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted fixes for this and many other vulnerabilities across Oracle products.
CVE-2026-83047 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or full access to all data accessible through Oracle WebCenter Portal. The attacker can also perform unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products. Customers are strongly advised to apply the available patches promptly to mitigate the risk.
CVE-2026-83046 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or all accessible data within Oracle WebCenter Portal. The vulnerability also permits causing a partial denial of service. The CVSS 3.1 base score is 7.1, reflecting high confidentiality impact and low availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions.
CVE-2026-83045 is a high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the portal, potentially leading to unauthorized access and modification of critical data. The vulnerability impacts confidentiality and integrity but does not affect availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products.