CVE-2026-73959: Oracle WebCenter Portal Auth Bypass Flaw

CVE-2026-73959 Overview

CVE-2026-73959 is an access control vulnerability in the Composer component of Oracle WebCenter Portal, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An authenticated attacker with low privileges and network access over HTTP can exploit the weakness to compromise the portal. Successful exploitation results in full takeover of Oracle WebCenter Portal, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in Security Alert CSPUSEP2026. The weakness is classified as Improper Access Control [CWE-284].

Critical Impact
A low-privileged network attacker can take over Oracle WebCenter Portal via the Composer component, compromising confidentiality, integrity, and availability.

Affected Products

Oracle WebCenter Portal 12.2.1.4.0
Oracle WebCenter Portal 14.1.2.0.0
Oracle Fusion Middleware (Composer component)

Discovery Timeline

2026-09-15 - CVE-2026-73959 published to NVD
2026-09-16 - Last updated in NVD database
Oracle Security Alert CSPUSEP2026 - Oracle publishes advisory and patch guidance

Technical Details for CVE-2026-73959

Vulnerability Analysis

The vulnerability resides in the Composer component of Oracle WebCenter Portal. Composer provides runtime page editing and customization features for portal users. Improper access control checks within Composer allow an authenticated user with low privileges to perform actions restricted to higher-privileged roles. According to Oracle Security Alert CSPUSEP2026, successful exploitation results in complete compromise of the portal instance.

The attacker requires network reachability to the portal over HTTP and a valid low-privileged account. No user interaction is needed, and exploitation complexity is low. Because the impact scope covers all three security properties, an attacker can read sensitive portal data, alter portal content and configurations, and disrupt availability of the service.

Root Cause

The underlying weakness maps to [CWE-284] Improper Access Control. The Composer component fails to consistently enforce authorization checks on privileged operations, permitting requests that should be rejected for low-privileged sessions. Oracle has not published detailed root-cause internals beyond the advisory reference.

Attack Vector

The attack originates from the network over HTTP against an exposed Oracle WebCenter Portal instance. The attacker authenticates using any low-privileged account and issues crafted requests to Composer endpoints. Because WebCenter Portal deployments are commonly reachable from internal networks and sometimes from the internet, exposure is broad. Detailed exploitation techniques are not disclosed in the public advisory. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical guidance.

Detection Methods for CVE-2026-73959

Indicators of Compromise

Unexpected modifications to portal pages, templates, or Composer artifacts performed by low-privileged accounts.
Creation of new administrative users, roles, or unexpected content deployments within WebCenter Portal.
Anomalous HTTP requests to Composer endpoints from user sessions that do not normally exercise administrative functionality.

Detection Strategies

Enable WebCenter Portal audit logging and correlate authorization failures and successes against Composer operations.
Baseline typical Composer usage per role and alert on deviations, especially privilege-sensitive actions issued by low-privileged users.
Inspect web server and WebLogic access logs for repeated requests to Composer URLs originating from a single low-privileged session.

Monitoring Recommendations

Forward WebLogic, WebCenter, and web-tier logs to a centralized SIEM for retention and correlation.
Monitor identity provider logs for unusual authentication activity preceding portal configuration changes.
Track file and configuration changes on WebCenter Portal servers with integrity monitoring tooling.

How to Mitigate CVE-2026-73959

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Oracle WebCenter Portal instances and confirm patch status across production, staging, and disaster recovery environments.
Review low-privileged accounts for signs of abuse and rotate credentials where exposure is suspected.

Patch Information

Oracle released fixes for CVE-2026-73959 in the CSPUSEP2026 Security Alert cycle. Administrators should download and apply the patches for Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 through My Oracle Support. Verify patch prerequisites for Oracle Fusion Middleware and WebLogic Server before deployment. Consult the Oracle Security Alert CSPUSEP2026 for the authoritative patch matrix.

Workarounds

Restrict network access to WebCenter Portal Composer endpoints to trusted management networks using web application firewall or reverse proxy rules.
Enforce least privilege on portal roles and remove unnecessary accounts that could be leveraged as the low-privileged foothold.
Increase monitoring on Composer activity until patches are applied across all instances.

bash

# Example: restrict access to WebCenter Portal Composer paths at a reverse proxy
# Replace <trusted_cidr> with your management network range
location ~* /webcenter/.*composer.* {
    allow <trusted_cidr>;
    deny all;
    proxy_pass http://webcenter_backend;
}