CVE-2026-73957

CVE-2026-73957 is a critical (CVSS 9.3) vulnerability in the Portlet Services component of Oracle WebCenter Portal, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker with HTTP access to the portal can exploit it, though a successful attack requires interaction from a victim other than the attacker, indicating a client-side attack path such as a crafted link or portlet content. Because the flaw changes scope, compromising WebCenter Portal can significantly impact additional products beyond it. A successful attack yields unauthorized creation, deletion, or modification of critical data, or complete unauthorized read access to all data accessible through WebCenter Portal, with high impact on both confidentiality and integrity (availability is unaffected). No public proof-of-concept exists and the vulnerability is not on the CISA KEV list, so exploitation is not known to be occurring in the wild.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to both 12.2.1.4.0 and 14.1.2.0.0 deployments, as Oracle has not indicated an alternative patch path. Restrict HTTP access to WebCenter Portal to trusted networks and authenticated users, since the flaw is exploitable pre-authentication over HTTP but requires victim interaction. Review portal and portlet logs for unauthorized data creation, deletion, or modification and for unexpected cross-product data access, and caution users against interacting with untrusted links or portlet content.