Oracle WebCenter Sites CVE-2026-61022

Exploitation requires a valid low-privileged account on the Oracle WebCenter Sites application, consistent with the CVSS PR:L designation. The attacker must have network access to the WebCenter Sites HTTP interface. No user interaction from a higher-privileged user is required (UI:N), and no elevated complexity, special sequencing, or race conditions are needed (AC:L). Oracle characterizes the vulnerability as 'easily exploitable,' and the CVSS vector indicates no non-default configuration is required beyond an accessible HTTP endpoint and a valid low-privileged credential. Limiting factors: exploitation is bounded to attackers who possess or can obtain a valid application-level account; unauthenticated external attackers without any credential cannot directly exploit this issue based on the PR:L designation.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a genuinely high-priority threat: network-accessible, low complexity, requiring only a low-privileged account, and delivering full CIA compromise. Oracle's own characterization as 'easily exploitable' reinforces the low exploitation bar. The unchanged scope (S:U) limits lateral impact to the WebCenter Sites system itself, but full takeover of a WCM platform typically means access to published content pipelines, credentials stored within the application, and potential footholds into internal network segments. No EPSS data is available in the provided intelligence, which limits probabilistic exploitation forecasting, and no KEV listing exists at the time of analysis - however, the combination of low complexity, low privilege requirement, and high impact means that even a mid-sized municipal IT team in walbrzych running this platform should treat this as urgent remediation rather than a routine patch cycle. The absence of a specific CWE introduces additional uncertainty about whether compensating controls are feasible; organizations should not assume workarounds are reliable until Oracle provides further technical guidance.

An attacker who holds a low-privileged account on the Oracle WebCenter Sites application - such as a content contributor or editor role - sends a specially crafted HTTP request to a vulnerable endpoint. The application processes the malicious request without adequate validation, allowing the attacker to escalate control and achieve full takeover of the WebCenter Sites instance, including access to all managed content, stored credentials, and underlying system resources. No public proof-of-concept code has been identified at the time of analysis, but Oracle's own description of the issue as 'easily exploitable' suggests that exploit development would not require exceptional technical sophistication.