Oracle WebCenter Sites CVE-2026-61007

No special conditions are required beyond HTTP network access to an Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 instance - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is possible against default configurations by any unauthenticated remote attacker. No specific non-default feature, protocol configuration, or privileged role is identified as a prerequisite in available data. Exploitation is bounded by confidentiality impact only: attackers cannot modify, delete, or corrupt data (I:N) and cannot disrupt service availability (A:N) through this vulnerability alone. Scope is unchanged (S:U), meaning this flaw does not directly provide lateral movement to other Fusion Middleware components or the underlying host. Internet-exposed deployments face the highest realistic risk; deployments behind network segmentation or VPN that restrict unauthenticated HTTP access materially reduce exploitability.

The vendor-assigned CVSS 3.1 score of 7.5 (High) accurately represents the exploitation ease: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) produce a trivially automatable attack surface. The confidentiality impact is maximal (C:H) - the description explicitly states complete access to all WebCenter Sites data - while integrity and availability are unaffected (I:N/A:N). The Authentication Bypass tag raises the operational risk above a generic information-disclosure finding, as it implies structural circumvention of the access control layer rather than a narrow data leak. EPSS data was not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified; however, AV:N/AC:L/PR:N/UI:N CVSS metrics align with the highest EPSS percentile profiles for Oracle products historically. CISA KEV status is not confirmed at time of analysis, and no public proof-of-concept has been identified - meaning this is not yet a confirmed active-exploitation event. Despite absent exploitation signals, the simplicity of attack conditions means defenders should treat this as high-priority patching rather than a watch-and-wait item, particularly for Internet-exposed WebCenter Sites deployments.

An unauthenticated attacker who can reach an Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 instance over HTTP issues a crafted request designed to bypass the application's authentication check, immediately gaining read access to the full content repository - including any sensitive documents, user-generated content, or configuration data managed by the platform. Given the low attack complexity and absence of any prerequisite, automated scanners could sweep IP ranges for exposed Oracle Fusion Middleware stacks and systematically exfiltrate data from all vulnerable instances at scale. No public proof-of-concept code has been identified at time of analysis, but independent exploit development is straightforward given the attack profile.