CVE-2026-73959

Analyzed Analyzed - Analysis Complete

Oracle WebCenter Portal Authentication Bypass

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-73959

EUVD

EUVD-2026-79313

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	webcenter_portal	12.2.1.4.0
oracle	webcenter_portal	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle WebCenter Portal's Composer component affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via HTTP to take over the entire Oracle WebCenter Portal system.

Detection Guidance

Detection of CVE-2026-73959 requires checking for vulnerable versions of Oracle WebCenter Portal (12.2.1.4.0 or 14.1.2.0.0) and monitoring for unauthorized access attempts via HTTP. Review Oracle WebLogic Server logs for suspicious activity and ensure all patches for this CVE are applied.

Impact Analysis

An attacker could gain full control of your Oracle WebCenter Portal, leading to unauthorized access, data theft, modification of content, or disruption of services. This could compromise sensitive information stored or processed by the portal.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's security and privacy rules. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0. If patches are unavailable, consider disabling the Composer component or restricting network access to the vulnerable service via firewall rules.

Hi! I’m here to help you understand CVE-2026-73959. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70