EUVD-2026-37318Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Sites host
-
DeliverySend crafted HTTP request to vulnerable endpoint
-
ExploitBypass authentication and gain WebCenter Sites takeover
-
ExecutionExecute privileged actions across scope boundary
-
ImpactExfiltrate or tamper with Fusion Middleware data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 reachable over HTTP, with no user interaction, no credentials, and no non-default settings required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The only meaningful limiters are network reachability of the WebCenter Sites HTTP listener (so instances behind VPN, IP allowlists, or internal-only segments are correspondingly harder to reach) and being on one of the two listed versions (12.2.1.4.0 or 14.1.2.0.0); the scope change (S:C) means impact is not confined to WebCenter Sites itself. |
| Impact | All risk signals point in the same direction: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0 score, meaning remote, network-reachable, unauthenticated exploitation with low complexity, no user interaction, and full confidentiality, integrity and availability loss extending beyond the vulnerable component via scope change. Oracle's own language ('easily exploitable', 'takeover') reinforces priority. Counter-signals are limited: there is no EPSS score, KEV listing, SSVC decision, or public POC in the provided data, so widespread mass exploitation has not been observed yet - but absence of these signals immediately after an Oracle CPU release is normal and should not be read as low risk. For any internet-exposed or partner-exposed WebCenter Sites instance this should be treated as a top-priority emergency patch; intranet-only deployments still warrant urgent patching given the trivial exploitability. |
| Exploit ScenarioDerived | An external attacker scans for internet-exposed Oracle WebCenter Sites instances and sends a single crafted HTTP request to a vulnerable endpoint, obtaining full administrative control of WebCenter Sites without any credentials or user interaction. Because the CVSS scope is Changed, the attacker then pivots from WebCenter Sites into the surrounding Fusion Middleware stack - for example modifying published content, exfiltrating customer data from connected stores, or executing code in the WebLogic container. No public exploit identified at time of analysis, but the trivial exploit profile means weaponization is plausible shortly after the CPU release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with a maximum CVSS 3.1 base score of 10.0 and a scope change indicating impact beyond the WebCenter Sites boundary. Oracle's June 2026 Critical Patch Update advisory (cspujun2026) lists the issue as easily exploitable with no privileges or user interaction required. There is no public exploit identified at time of analysis and the flaw is not currently listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update of June 2026 for Oracle WebCenter Sites on both 12.2.1.4.0 and 14.1.2.0.0, following the bundle and prerequisite instructions in https://www.oracle.com/security-alerts/cspujun2026.html (exact patched build numbers are published in the CPU advisory and My Oracle Support patch matrix). Until the CPU can be deployed, restrict HTTP/HTTPS reachability of WebCenter Sites - particularly the management and delivery endpoints - to trusted networks via WAF rules, reverse-proxy ACLs, or network segmentation, and increase monitoring of WebCenter Sites and the underlying WebLogic logs for anomalous unauthenticated requests; note that ACL-based restrictions break public delivery sites and WAF virtual-patching without a vendor signature is best-effort only. Do not rely on disabling individual features as a workaround, as no feature-level mitigation is published in the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is an enterprise web experience and content management platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic and exposed via HTTP/HTTPS for both authoring and delivery tiers. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_sites:*:*:*:*:*:*:*:* confirms the WebCenter Sites application itself is the vulnerable component rather than an underlying library. No CWE is assigned in the input, but the combination of network attack vector, low complexity, no privileges, scope change, and full CIA impact is characteristic of an authentication-bypass or unauthenticated remote code execution issue in an HTTP-facing handler that allows the attacker to break out of the application's security boundary and affect adjacent components (for example the underlying WebLogic container, file system, or integrated identity store).
Know when Oracle Webcenter Sites gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable, unauthenticated, low-complexity takeover with no user interaction; Oracle confirms scope change and full CIA impact on WebCenter Sites and adjacent components.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical remote vulnerability enabling unauthenticated system takeover with CVSS 10.0 severity. Any organization operating affected versions faces immediate risk of total infrastructure compromise without requiring valid credentials or user interaction. Urgent action is required to identify vulnerable systems and implement containment measures pending vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network-level access to affected WebCenter Sites systems using firewall rules, monitor HTTP/network traffic for exploitation patterns, and maintain expedited deployment procedures for rapid patching upon vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Sites
View allRemote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated network attackers ove
Remote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with the vend
Remote takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to
Unauthenticated remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing attac
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated attackers over HTTP,
Remote code execution and full product takeover affects Oracle WebCenter Sites 14.1.2.0.0 within Oracle Fusion Middlewar
Unauthenticated remote compromise of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing att
Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged remote attacker with HTTP a
Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with
Takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible when a low-privileged attacker with HTTP networ
GitHub PoC
Exploit-DB