Oracle WebCenter Sites CVE-2026-61008

No special conditions - remote unauthenticated exploitation over HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 (AV:N/AC:L/PR:N/UI:N), per Oracle's 'easily exploitable' characterization. The practical limiting factor is network reachability: the WebCenter Sites HTTP interface must be accessible to the attacker, so instances confined to internal networks or behind authenticated reverse proxies are less exposed than internet-facing deployments. Exploitation is confined to these two supported versions; other versions are not listed as affected in the provided data, and no non-default feature toggle is cited as a prerequisite.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the vector AV:N/AC:L/PR:N/UI:N describes remote, low-complexity, unauthenticated exploitation with no user interaction, and Oracle itself calls it 'easily exploitable.' The 9.1 score is driven by high confidentiality and integrity impact with no availability impact (S:U), consistent with a data compromise / authentication-bypass class of bug. Mitigating the urgency somewhat, no EPSS probability was provided, there is no KEV listing, and no public proof-of-concept is referenced, so exploitation appears possible but not yet demonstrated in the wild; because these are unauthenticated, internet-reachable content platforms, even a mid-sized municipal IT team should treat this as urgent and patch on Oracle's Critical Patch Update cadence rather than waiting for a working exploit. The main conflict in the data is the missing CWE and EPSS, which limits precision but does not lower the demonstrated blast radius.

An attacker who can reach a WebCenter Sites instance over HTTP sends a crafted request to a content-management endpoint that should require authentication; because the flaw bypasses authentication, the request is processed with privileged access. The attacker then reads sensitive site content and configuration data and alters or deletes published content, potentially defacing sites or planting malicious content, all without any credentials or user interaction. No public proof-of-concept is referenced in the source data.