CVE-2026-73952

CVE-2026-73952 is a critical (CVSS 9.1) vulnerability in the Portlet Services component of Oracle WebCenter Portal, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack lets the attacker create, delete, or modify critical data — or all data accessible to WebCenter Portal — as well as read critical data or gain complete access to all WebCenter Portal accessible data; availability is not impacted per the CVSS vector (C:H/I:H/A:N). Organizations running the affected portal versions, especially instances reachable over the network, are at risk of full compromise of portal content and confidentiality. There is no known public PoC, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-73952 to instances running WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 as soon as it is available, prioritizing any portal exposed to untrusted networks. Restrict HTTP access to WebCenter Portal and its Portlet Services endpoints via firewall rules or VPN-only access, and review logs for unauthenticated requests to portlet endpoints indicating tampering or data access.