Oracle WebCenter Sites CVE-2026-61021

Exploitation requires network access to the WebCenter Sites HTTP interface plus a low-privileged authenticated foothold (CVSS PR:L) - a valid but low-permission application account, not anonymous access. No user interaction is required (UI:N) and complexity is low (AC:L), so once an attacker holds any low-privileged credential, exploitation is easy per Oracle. Limiting factors: the attacker must reach the WebCenter Sites HTTP endpoints (internal-only or network-restricted deployments raise the bar) and must already possess or acquire a low-privileged account; affected supported versions are specifically 12.2.1.4.0 and 14.1.2.0.0. The scope change (S:C) means impact can extend beyond WebCenter Sites into other integrated products.

Signals are largely consistent toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) shows network-reachable, low-complexity, no-user-interaction exploitation requiring only low privileges, yielding scope-changing total compromise - Oracle explicitly calls it 'easily exploitable.' The main tempering factor is the PR:L requirement: an attacker needs some authenticated foothold (e.g., a low-privileged application account) rather than fully anonymous access, which narrows the pool of opportunistic attackers relative to a PR:N flaw. Counterbalancing signals point to lower immediate real-world pressure: there is no CISA KEV listing (no confirmed active exploitation), no public POC identified, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: treat as a top-tier patch priority for any exposed WebCenter Sites instance because of the 9.9 severity and low exploitation bar, while noting that absence of KEV/POC/EPSS data means widespread active exploitation is not currently evidenced. CWE is N/A and the vendor tag ('Information Disclosure') conflicts with the full C/I/A/takeover impact - the vector should be trusted over the tag; verify specifics with Oracle.

An attacker who has obtained or been granted a low-privileged WebCenter Sites account sends crafted HTTP requests to the application, exploiting the flaw to escalate to full takeover of the WebCenter Sites instance and, via the scope change, to pivot into additional integrated Fusion Middleware resources. No public POC has been identified, and given AV:N/AC:L/UI:N the attack is straightforward once a foothold account exists.