CVE-2026-91246: CSRF
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data as well as unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle WebCenter Portal deployments running supported versions 12.2.1.4.0 or 14.1.2.0.0 are affected. The vulnerable component is Runtime Tools, and the attack can be delivered over HTTP from the network.
Does an attacker need an account or special access?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, but successful exploitation requires interaction by someone other than the attacker.
What could a successful attack allow?
An attacker may gain unauthorized read access to a subset of accessible Oracle WebCenter Portal data and unauthorized ability to update, insert, or delete some accessible data. The scope can extend beyond WebCenter Portal and significantly affect additional products.