Oracle WebCenter Sites CVE-2026-61011

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against network-accessible Oracle WebCenter Sites instances running the affected versions via standard HTTP. There is no requirement for a specific non-default configuration, privileged account, or victim interaction. The primary limiting factor is version scope: only versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed vulnerable; organizations running earlier unsupported versions or future patched releases are not affected by this specific CVE. Network accessibility is the sole structural prerequisite - deployments isolated behind strict network controls or not exposed over HTTP will have reduced exposure.

The CVSS 3.1 score of 8.2 (High) is well-supported by the vector metrics: AV:N (network-reachable), AC:L (no complexity barriers), PR:N (unauthenticated), and UI:N (no victim interaction required). These four attributes in combination represent the most dangerous attack surface profile - exploitation is straightforward and can be attempted at scale. The I:H metric reflects full write/delete access to critical WebCenter Sites data, which for a CMS means attackers could deface content, inject malicious payloads into managed pages, or destroy site assets. A:L indicates partial disruption capability, consistent with the 'partial DOS' language in the description. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified - however, these are absence-of-evidence signals, not evidence of safety. The unauthenticated, low-complexity attack profile means exploitation probability is structurally high regardless of the lack of current KEV/POC confirmation.

An unauthenticated attacker identifies an internet-exposed Oracle WebCenter Sites instance running version 12.2.1.4.0 or 14.1.2.0.0 and sends crafted HTTP requests to the vulnerable component - requiring no credentials or prior foothold. The attacker successfully modifies, deletes, or injects content into the CMS data store, enabling website defacement, malicious content injection into managed pages, or disruption of site availability. No public exploit code has been identified at time of analysis, but the AV:N/AC:L/PR:N profile means exploitation requires only knowledge of the vulnerability and a reachable target.