Oracle WebCenter Sites CVE-2026-101499

No special conditions - remote unauthenticated exploitation over HTTP against Oracle WebCenter Sites (component: WebCenter Sites) as described by the vendor, with no authentication, user interaction, or non-default configuration stated as required (AV:N/AC:L/PR:N/UI:N). The primary LIMITING factors are therefore deployment-based rather than technical: the attacker must have network/HTTP reachability to a vulnerable instance, and only supported versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected. The CVE description names no specific feature, protocol mode, or configuration toggle as a precondition, so exploitation appears to apply to default installations of the affected versions.

All CVSS signals point to maximum network-exploitability: the vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base 9.8) means a remote, unauthenticated attacker over HTTP with low attack complexity and no user interaction can achieve full confidentiality, integrity, and availability compromise - Oracle explicitly describes this as 'takeover of Oracle WebCenter Sites.' This is the archetype of a genuine patch-now priority rather than a high-CVSS-but-low-real-risk issue, because the pre-authentication network vector removes the usual mitigating prerequisites. However, several real-world exploitation signals are MISSING from the input and must not be assumed: no EPSS probability was provided, the CVE is NOT listed as KEV (no confirmed active exploitation), and no public POC is referenced, so this is best characterized as high potential severity with no confirmed exploitation yet. Note also a conflict in the provided metadata: the only tag describing impact is 'Information Disclosure,' which understates a vulnerability that the description and CVSS both rate as full C/I/A takeover - treat the full-takeover characterization (vendor + CVSS) as authoritative over the tag.

An attacker reachable over the network sends a crafted HTTP request directly to an internet-exposed or internal Oracle WebCenter Sites instance (versions 12.2.1.4.0 or 14.1.2.0.0) without any credentials. Because attack complexity is low and no user interaction is required, a single request chain can escalate to full application takeover, letting the attacker read/modify content and control the server. No public exploit code is identified at time of analysis, so this scenario is based on the vendor-described capability rather than an observed exploit.