CVE-2026-83041

Oracle WebCenter Portal (part of Oracle Fusion Middleware) contains an easily exploitable flaw in its Portlet Services component that allows a low-privileged, authenticated attacker with network access via HTTP to read data they should not be able to access. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data, and because the vulnerability changes scope, successful attacks may also significantly impact additional products beyond WebCenter Portal itself. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0, and requires only a low-privilege account, making insider or compromised-account abuse the most likely attack path. There is no known public proof of concept and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation has been observed. The CVSS 3.1 base score is 7.7 (high), driven entirely by high confidentiality impact with no integrity or availability impact.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all WebCenter Portal installations running 12.2.1.4.0 or 14.1.2.0.0, since no fixed version is identified outside the CPU. Review low-privileged portal and portlet accounts for compromise or abuse, and audit access logs for unusual retrieval of portlet-served or cross-product data. Restrict HTTP exposure of Portlet Services endpoints to trusted networks and users where feasible.