Skip to main content

Oracle WebCenter Sites CVE-2026-61018

| EUVDEUVD-2026-61308 CRITICAL
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-q7p9-32v5-998p
Oracle Authentication Bypass Webcenter Sites
9.8
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.8 CRITICAL

Oracle describes easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N) resulting in full takeover, justifying C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 04:13 vuln.today
CVE Published
Aug 18, 2026 - 21:16 nvd
CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation over HTTP against affected Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the patch available per Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html), which is the authoritative source for the exact patched build numbers for the 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not publish standalone fix version strings in the CPU text, so obtain the specific patch set from My Oracle Support and apply it in a staged environment first. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 and immediately implement network segmentation or restrict HTTP/HTTPS access to trusted sources only; assess current network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Webcenter Sites

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2015-3253 CRITICAL
9.8 Aug 13

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
CVE-2021-45105 MEDIUM
5.9 Dec 18

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
CVE-2021-29505 HIGH POC
8.8 May 28

XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2019-2578 HIGH POC
8.6 Apr 23

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CVE-2018-2791 HIGH POC
8.2 Apr 19

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CVE-2020-5258 HIGH POC
7.7 Mar 10

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severit
CVE-2020-7226 HIGH POC
7.5 Jan 24

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excess
CVE-2019-5427 HIGH POC
7.5 Apr 22

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
CVE-2013-4316 CRITICAL
10.0 Sep 30

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack v
CVE-2018-3238 MEDIUM POC
6.9 Oct 17

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated med
CVE-2020-11023 MEDIUM POC
6.1 Apr 29

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-61018 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy