Oracle WebCenter Sites CVE-2026-61033

No special conditions are required beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default configurations of Oracle WebCenter Sites over HTTP. Both supported versions (12.2.1.4.0 and 14.1.2.0.0) are vulnerable as shipped. The specific sub-component or feature within WebCenter Sites that exposes the flaw is not identified in available data, preventing assessment of whether a non-default feature must be enabled. Exploitation is limited to deployments where WebCenter Sites is network-accessible to the attacker; instances isolated on private networks without external exposure are at reduced risk. No user interaction, authenticated session, or special server-side configuration is required to trigger the vulnerability.

The CVSS 3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L represents a high-severity, remotely exploitable pre-authentication flaw - arguably the most dangerous exploitation profile absent a scope change. The confidentiality impact is rated High (complete data access), while integrity and availability impacts are Low, matching the description of partial write capability and partial DOS. No EPSS score is available in the provided data, preventing probabilistic exploitation likelihood comparison with the CVSS signal. The vulnerability has not been added to CISA's KEV catalog and no public exploit code has been identified, which moderates the immediacy of real-world risk somewhat. However, the 'Easily exploitable' language in the Oracle advisory and the AC:L/PR:N profile mean that once technical details are published or reverse-engineered from the patch, exploitation by moderately skilled attackers is plausible with minimal tooling. Internet-facing WebCenter Sites deployments should treat this as a high-priority patch item; internal-only deployments with network controls in place face reduced but non-zero risk.

An unauthenticated attacker with network access to an Oracle WebCenter Sites instance sends a crafted HTTP request that bypasses the application's authentication controls, gaining unauthorized read access to all content, configuration data, and user data managed by the CMS. The attacker may additionally perform limited unauthorized data modifications - such as altering managed content - or trigger a partial denial of service that disrupts content delivery to end users. No public proof-of-concept has been identified at time of analysis, but the low attack complexity indicates the technique would not require advanced capabilities once the authentication bypass mechanism is understood.