CVE-2026-73948

CVE-2026-73948 is a critical (CVSS 9.9) vulnerability in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker holding only low-privileged credentials can exploit it over HTTP with no user interaction, and successful attacks result in a complete takeover of the WebCenter Portal deployment. The CVSS scope-change designation (S:C) means compromises can also significantly impact additional products beyond WebCenter Portal itself, with high confidentiality, integrity, and availability consequences. Only organizations running the two affected WebCenter Portal versions are exposed, and exploitation requires an authenticated session, so attackers would typically chain it with stolen or weak low-privilege credentials. No public proof-of-concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remedies this CVE to all WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 installations as soon as it is available, prioritizing any instance reachable over a network. Enforce strong authentication and least-privilege role assignments for portal users, and audit low-privilege accounts for suspicious activity or privilege changes. Because the flaw carries a scope change, also review and harden adjacent Fusion Middleware products integrated with the portal after patching.