EUVD-2026-61311
GHSA-4jw3-w5fw-43v4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated HTTP reach (AV:N/PR:N/UI:N) but 'difficult to exploit' justifies AC:H; takeover plus impact on other products gives S:C and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the WebCenter Sites HTTP interface and no authentication or user interaction (AV:N/PR:N/UI:N), but is gated by high attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - such as specific timing, configuration state, or a required preparatory step - which is why Oracle labels it 'difficult to exploit.' Limiting factors that reduce realistic risk: only versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected; the target instance's vulnerable HTTP endpoint must be network-reachable to the attacker; and the AC:H barrier meaningfully raises the skill/effort threshold versus a trivial unauthenticated exploit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and must be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html - Patch available per vendor advisory; consult that CPU matrix for the exact patch/interim patch numbers corresponding to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, as no discrete fixed build string was included in the source data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems running Oracle WebCenter Sites versions 12.2.1.4.0 or 14.1.2.0.0, prioritizing instances exposed to untrusted networks or the internet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Webcenter Sites
View allWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severit
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excess
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack v
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated med
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today