Oracle WebCenter Sites CVE-2026-61038

No special conditions are required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites. Any deployment of versions 12.2.1.4.0 or 14.1.2.0.0 with the WebCenter Sites HTTP interface network-reachable is exposed; no specific feature flag, non-default configuration, or enabled plugin is identified as a prerequisite. Exploitation is limited to environments where the WebCenter Sites HTTP service is accessible from the attacker's network segment - deployments isolated entirely from untrusted networks (e.g., strict perimeter firewalling with no external HTTP exposure) significantly reduce realistic risk, though the underlying vulnerability remains present and unpatched.

The CVSS 3.1 score of 8.2 High is well-supported by the vector AV:N/AC:L/PR:N/UI:N - the most dangerous base metric combination, requiring no authentication, no special configuration, and no victim interaction over a network-accessible HTTP channel. Confidentiality impact is rated High, meaning an attacker could access the entirety of data within WebCenter Sites' scope, while Integrity is Low, permitting limited write operations. No EPSS score was available in the provided data, so exploitation probability cannot be quantified; however, authentication bypass vulnerabilities with AV:N/AC:L/PR:N are historically among the most exploited classes because they require minimal attacker skill and are easily automated - even a mid-sized municipal IT team in olsztyn should treat this as urgent regardless of whether active exploitation is yet confirmed. The absence of a CISA KEV listing and lack of known public exploit code slightly reduce immediate threat urgency compared to confirmed in-the-wild exploitation, but these signals can change rapidly for Oracle Fusion Middleware components given their enterprise prevalence. No conflicting CVSS signals were identified; the description, vector, and tags are fully consistent.

An unauthenticated attacker with HTTP network access to the WebCenter Sites instance crafts and sends a request to a vulnerable endpoint, circumventing the platform's authentication controls to directly retrieve sensitive content, user, or configuration data managed by WebCenter Sites. The attacker may also perform limited data write operations - such as inserting or modifying content records - without any valid credentials. No public exploit code has been identified, but the low-complexity, zero-prerequisite nature of the attack makes independent exploit development highly feasible for a moderately skilled attacker.