CVE-2026-61199: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-61199 Overview

CVE-2026-61199 is an access control vulnerability in the Runtime Tools component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. The flaw affects version 14.1.2.0.0 and allows a low-privileged attacker with network access over HTTP to compromise the application. Successful exploitation can lead to unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. The vulnerability carries a scope change, meaning exploitation can impact resources beyond the vulnerable component itself. Oracle addressed the issue in its August 2026 Critical Patch Update advisory.

Critical Impact
A low-privileged remote attacker can read all data accessible to Oracle WebCenter Portal, with impact extending to additional products through scope change.

Affected Products

Oracle Fusion Middleware
Oracle WebCenter Portal 14.1.2.0.0
Runtime Tools component

Discovery Timeline

2026-08-18 - CVE-2026-61199 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-61199

Vulnerability Analysis

CVE-2026-61199 resides in the Runtime Tools component of Oracle WebCenter Portal. The weakness is categorized under [CWE-284: Improper Access Control]. An attacker with a valid low-privileged account can send crafted HTTP requests to interact with functionality that should be restricted. The confidentiality impact is high, while integrity and availability remain unaffected. The scope change indicates that a successful attack can affect components outside the vulnerable module, expanding the blast radius to related Fusion Middleware services and data. According to the Exploit Prediction Scoring System (EPSS), the current probability of exploitation is 0.27%.

Root Cause

The root cause is improper access control within the Runtime Tools component. The application does not adequately enforce authorization checks on requests that expose sensitive portal data. Users authenticated with minimal privileges can therefore reach resources and administrative functionality reserved for higher-privileged roles.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker requires low privileges but no user interaction and no elevated complexity. After authenticating to Oracle WebCenter Portal, the attacker issues crafted requests to Runtime Tools endpoints. These requests bypass authorization boundaries and return data belonging to other users or system components. No verified public proof-of-concept code is available at the time of writing. Refer to the Oracle Security Alert for authoritative technical details.

// No verified public exploit code available.
// See the Oracle Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-61199

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts to Oracle WebCenter Portal Runtime Tools endpoints.
Authenticated sessions accessing portal resources or data outside the user's assigned role scope.
Anomalous volume of successful HTTP 200 responses returning sensitive portal content to standard users.

Detection Strategies

Enable and review WebLogic and WebCenter Portal audit logs for authorization decisions on Runtime Tools URLs.
Correlate authentication events with subsequent access to administrative or cross-tenant portal resources.
Deploy web application firewall (WAF) signatures that flag requests to Runtime Tools paths originating from non-administrative roles.

Monitoring Recommendations

Track HTTP access patterns to /webcenter/ and Runtime Tools endpoints, alerting on privilege-role mismatches.
Baseline normal user activity in Oracle WebCenter Portal and alert on outliers in data volume retrieved.
Forward Fusion Middleware logs to a centralized SIEM for retention and correlation across identity and application layers.

How to Mitigate CVE-2026-61199

Immediate Actions Required

Apply the fix from the Oracle Critical Patch Update Advisory published in August 2026 to all Oracle WebCenter Portal 14.1.2.0.0 deployments.
Inventory all Fusion Middleware instances to confirm patch coverage across production and non-production environments.
Rotate credentials for any low-privileged accounts that showed anomalous activity prior to patching.

Patch Information

Oracle released a security fix as part of the August 2026 Critical Patch Update. Administrators should follow the guidance published in the Oracle Security Alert and apply the patch to Oracle WebCenter Portal version 14.1.2.0.0.

Workarounds

Restrict network access to Oracle WebCenter Portal to trusted management networks until the patch is deployed.
Enforce least-privilege role assignments and audit all low-privileged accounts with portal access.
Place a reverse proxy or WAF in front of the portal to filter unauthorized requests to Runtime Tools paths.

bash

# Example: restrict access to Runtime Tools paths at the reverse proxy
location ~* /webcenter/.*runtime.*  {
    allow 10.0.0.0/8;
    deny  all;
}