Oracle WebCenter Sites CVE-2026-61016

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no elevated privileges, no user interaction, and low attack complexity are required. The primary factor limiting exploitation is network reachability: deployments protected behind a firewall, VPN, or network segmentation layer that restricts external HTTP access to the WebCenter Sites application will have substantially reduced exposure. Confidentiality is not impacted (C:N in the CVSS vector), which limits attacker objectives to content data manipulation and partial service disruption rather than information exfiltration. Both supported version branches (12.2.1.4.0 and 14.1.2.0.0) are affected, so version-based triage provides no relief.

The CVSS 3.1 base score of 8.2 is well-supported by the AV:N/AC:L/PR:N/UI:N vector, which together signal a straightforward, unauthenticated network attack requiring no user involvement - a profile that genuinely warrants high-priority remediation rather than being a case of inflated scoring. Integrity impact is rated High (unauthorized write, create, and delete access to all WebCenter Sites data), while Availability impact is Low (partial DOS only) and Confidentiality is not affected (C:N), so the primary business risk is content tampering and platform disruption rather than data exfiltration. No EPSS score was provided in the available intelligence, meaning probabilistic exploitation likelihood cannot be quantified against the broader threat landscape; active exploitation is not confirmed (no CISA KEV listing) and no public proof-of-concept has been identified. The absence of a CWE classification is a meaningful gap - without knowing the root cause class, defenders cannot assess how easily the flaw can be discovered and replicated independently. Given the zero-prerequisite exploitation profile, even a mid-sized municipal IT team in legnica managing a Fusion Middleware deployment should treat this as urgent once patches are released, particularly for any internet-exposed WebCenter Sites instances. The Denial of Service tag from the intelligence metadata is consistent with the A:L metric, reinforcing partial availability impact as a secondary risk.

An unauthenticated remote attacker with HTTP access to an exposed Oracle WebCenter Sites instance sends a crafted request to the vulnerable component, requiring no credentials, no elevated privileges, and no victim interaction. The attacker successfully manipulates, creates, or deletes critical content data across WebCenter Sites - for example, defacing published web content or destroying content records - or induces a partial denial of service affecting platform availability. No public proof-of-concept has been identified at time of analysis, but the low-complexity, no-authentication profile makes independent exploit development accessible to moderately skilled threat actors.