EUVD-2026-61308
GHSA-q7p9-32v5-998p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Sites HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger vulnerability in WebCenter Sites component
-
ExecutionAchieve application takeover
-
ImpactExfiltrate or alter managed content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against affected Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network reachability: the attacker must be able to reach the WebCenter Sites HTTP interface, so instances that are not internet-exposed and are restricted to internal or VPN-only access are only exploitable by attackers with that network position. Exploitation is confined to the two named supported versions; other versions are not listed as affected in the provided data. |
| Impact | This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector is maximally severe on the exploitability side (AV:N, AC:L, PR:N, UI:N) with full C/I/A impact leading to 'takeover' per Oracle's own wording, and Oracle explicitly characterizes it as 'easily exploitable' by an unauthenticated network attacker - the strongest exploitability language Oracle uses. No EPSS score, SSVC decision, or KEV entry is present in the provided data, and no public proof-of-concept is referenced, so real-world exploitation cannot yet be confirmed; however, absence of those signals so soon after a CPU release is expected and should not be read as low risk. Internet-exposed WebCenter Sites instances are the highest-concern deployments, and any organization running the affected versions - from a large enterprise down to a small operator with a modest IT team - should treat patching as urgent given the pre-authentication, full-takeover profile. The main uncertainty is the missing CWE and technical detail, which limits ability to build compensating controls precisely. |
| Exploit ScenarioDerived | An attacker scans for internet-exposed Oracle WebCenter Sites instances and sends a crafted HTTP request to a vulnerable endpoint without needing any credentials or user interaction. Because the flaw yields full application takeover, the attacker gains control of the WebCenter Sites application, enabling theft or modification of managed web content and pivoting into the underlying Fusion Middleware environment. No public exploit is identified at time of analysis, but the low complexity and pre-authentication nature make weaponization straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
RemediationAI
Apply the patch available per Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html), which is the authoritative source for the exact patched build numbers for the 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not publish standalone fix version strings in the CPU text, so obtain the specific patch set from My Oracle Support and apply it in a staged environment first. Until patching completes, reduce exposure by restricting network access to the WebCenter Sites HTTP endpoints - place the application behind a VPN or IP allowlist and remove any direct internet exposure of administrative or content-delivery interfaces, accepting that this may disrupt legitimate external content access. Additionally, front the application with a WAF and monitor WebLogic and WebCenter Sites access logs for anomalous unauthenticated requests; these are stopgaps only, since the undisclosed root cause means signature-based blocking cannot be guaranteed complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is an enterprise web experience management (WEM) and content-management platform bundled within Oracle Fusion Middleware, typically deployed on WebLogic Server to power large public-facing corporate and marketing websites. The advisory identifies the affected component only as 'WebCenter Sites' and assigns no CWE, so the precise root-cause class (e.g., deserialization, authentication bypass, injection) is not disclosed by Oracle - consistent with Oracle's standard practice of withholding technical detail in Critical Patch Update notices. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable code path in the HTTP-facing application layer that requires no credentials and no user interaction to reach, which is characteristic of pre-authentication flaws in exposed middleware endpoints.
Know when Webcenter Sites gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N) resulting in full takeover, justifying C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling unauthenticated remote attackers to completely compromise affected systems over standard HTTP connections. Organizations running these versions face immediate risk of data loss, application shutdown, and potential regulatory exposure without urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation to isolate affected systems; deploy Web Application Firewall (WAF) rules configured to block exploitation patterns; enable enhanced logging and real-time alerting on access attempts; assess feasibility of disabling non-essential WebCenter Sites instances; evaluate alternative applications for business-critical functions; establish incident response procedures specific to this vulnerability pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Sites
View allWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severit
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excess
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack v
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. Rated critical severity (C
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated med
Exploit-DB