Oracle WebCenter Sites CVE-2026-61032

Exploitation requires a valid low-privileged account on the Oracle WebCenter Sites application - at minimum, standard authenticated user-level credentials are needed; no administrative or elevated role is required. Network access to the WebCenter Sites instance over HTTP is necessary, and the attack path requires no victim user interaction. Affected deployments are specifically those running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 as part of Oracle Fusion Middleware; no non-default configuration is implied as a prerequisite. The primary limiting factor is possession of at least one valid application credential, which in enterprise environments may be acquired through phishing, credential reuse, or insider access. The Scope:Unchanged characteristic means the attack does not inherently break out of the WebCenter Sites application boundary without additional post-exploitation steps.

The CVSS 3.1 score of 8.8 reflects a genuinely high-severity vulnerability: network-reachable over HTTP, low attack complexity, requiring only a low-privileged account with no user interaction, and resulting in full confidentiality, integrity, and availability compromise. Oracle's own classification of 'easily exploitable' reinforces the AC:L metric and indicates the attack path is straightforward once credentials are obtained. No EPSS probability data was available in the provided intelligence, and this CVE is not listed in the CISA KEV catalog, meaning confirmed active exploitation has not been reported to U.S. authorities. No public proof-of-concept code has been identified. Despite the absence of confirmed exploitation, the combination of easy exploitability and total takeover potential means that even a mid-sized municipal IT team in mielec running Oracle Fusion Middleware should treat this as urgent remediation rather than a deferred patch. The Scope:Unchanged metric limits blast radius to the WebCenter Sites instance itself, but full platform takeover of a content management system carries significant secondary risk including web defacement, data exfiltration of managed content, and lateral movement using harvested credentials.

An attacker who has obtained a low-privileged Oracle WebCenter Sites account - through credential phishing, password spraying, or an insider - sends a specially crafted HTTP request to a vulnerable endpoint on versions 12.2.1.4.0 or 14.1.2.0.0. The application fails to enforce proper authorization controls, allowing the attacker to escalate to full platform control and achieve arbitrary read/write access to managed content, application configuration, and underlying data. No public proof-of-concept has been identified, but Oracle's 'easily exploitable' classification suggests minimal technical sophistication is required beyond credential access.