EUVD-2026-46917
GHSA-w99x-5mh3-5qrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebCenter Sites HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger flaw in WebCenter Sites component
-
ExecutionGain control of application
-
ImpactFull platform takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against supported configurations of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible, as indicated by AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' characterization. The only prerequisite is network HTTP access to the WebCenter Sites application, meaning the primary limiting factor is network exposure: instances reachable only from trusted internal or management networks are substantially harder to reach than internet-facing deployments. No authentication, no user interaction, and no non-default feature toggle are required per the available data; the affected versions are limited to the two supported releases Oracle names, so instances on other patched builds are out of scope. |
| Impact | All available signals point to high real-world risk. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with no user interaction and total impact - Oracle reinforces this by explicitly labeling it 'easily exploitable' and stating attacks can 'result in takeover.' EPSS was not provided in the input, and no SSVC decision data was supplied, so automatability and exploitation-status scoring cannot be independently cross-referenced. It is not in CISA KEV and no POC was reported, so this is not confirmed active exploitation; however, the combination of a 9.8 score, unauthenticated network vector, and Oracle's 'easily exploitable' language means this should be treated as a genuine priority rather than an inflated high-CVSS-but-low-risk finding. The main uncertainty is the absence of technical root-cause detail (CWE N/A) and EPSS/KEV corroboration, which are typical for Oracle CPU disclosures. |
| Exploit ScenarioDerived | An attacker who can reach the WebCenter Sites HTTP interface over the network sends a crafted request that exploits the flaw without any credentials or user interaction, achieving full compromise ('takeover') of the platform. Given AV:N/AC:L/PR:N, this requires only network reachability to the web application and no authentication. No public exploit code has been identified at time of analysis, but the low complexity means exploit development is likely feasible once details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.
RemediationAI
Apply the patches from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances; Oracle CPU patches are cumulative, so applying the July 2026 CPU is the primary and authoritative fix. Oracle does not publish a discrete standalone fix version beyond the CPU bundle, so the exact patched build should be taken from the CPU patch set for your installed version. Until patching is complete, reduce exposure by restricting HTTP/HTTPS access to the WebCenter Sites application to trusted management networks or via a VPN, placing the application behind a WAF or reverse proxy with strict request filtering, and blocking direct internet access to administrative and content-delivery endpoints - noting that WAF rules are imperfect without root-cause detail and network restrictions may break legitimate public-site delivery, so these are stopgaps rather than substitutes for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is an enterprise web experience management (WEM) / content management platform bundled within Oracle Fusion Middleware, used to author, manage, and deliver large-scale customer-facing websites. The vulnerable component is identified simply as 'WebCenter Sites' itself, meaning the flaw sits in the core application/HTTP-facing layer rather than an optional add-on. Oracle did not assign a CWE (listed as N/A) and does not disclose root-cause details in its CPU advisories, so the specific weakness class (e.g., deserialization, authentication bypass, or injection) cannot be confirmed from the available data; the 'Information Disclosure' tag and the full C:H/I:H/A:H 'takeover' outcome suggest a high-privilege pre-authentication code or data access path. No CPE strings were provided, so affected configurations are derived from Oracle's named version list.
Know when Webcenter Sites gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated (PR:N), network HTTP (AV:N), easily exploitable (AC:L) attack yielding full takeover, so C/I/A all High with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote compromise without authentication, requiring only standard HTTP network access-a critical threat to data confidentiality and operational continuity. With no patch currently available and a CVSS score of 9.8, this vulnerability represents an urgent organizational risk demanding immediate network isolation and vendor engagement. Any organization running these versions faces substantial exposure to data breach and service disruption.
No vendor-released patch identified at time of analysis; interim protections include network segmentation restricting unauthenticated HTTP access to WebCenter Sites, deployment of Web Application Firewall rules to detect and block exploitation attempts, enhanced logging and real-time monitoring for suspicious activity, and prioritized vendor engagement to obtain patch timeline and any available temporary mitigations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Sites
View allWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severit
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excess
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack v
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (C
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated med
Exploit-DB