Oracle WebCenter Sites CVE-2026-61040

The attacker must hold a valid low-privilege account on the target Oracle WebCenter Sites instance - any authenticated role appears sufficient per the PR:L CVSS metric, though the specific minimum role is not identified in Oracle's disclosure. Network access to the WebCenter Sites HTTP interface is required (AV:N). No user interaction from any higher-privileged session is needed (UI:N), and attack complexity is low (AC:L), meaning no race conditions, special timing, or unusual environmental states are required. Exploitation is bounded to the two explicitly affected versions (12.2.1.4.0 and 14.1.2.0.0); whether a specific WebCenter Sites module or configuration must be active is unknown due to the absence of CWE and component-level detail.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a genuinely high-priority vulnerability: network-accessible, low complexity, no user interaction, and full CIA impact - all signals that exploitation is practical for any authenticated user without special conditions. No EPSS score was present in the source intelligence, and the vulnerability is absent from the CISA KEV catalog, meaning confirmed active exploitation is not established; however, the absence from KEV should not be mistaken for low urgency, as Oracle's own 'easily exploitable' label reflects a very low technical bar. Even a mid-sized municipal IT team in malbork running WebCenter Sites as their public-facing portal should treat this as urgent given the exposure profile. A notable inconsistency exists between the EUVD tag of 'Information Disclosure' and the full CIA impact and 'takeover' language from Oracle - the tags likely underrepresent severity and should not be used for triage. The absence of a CWE identifier means compensating controls cannot be targeted at a known flaw class, increasing reliance on network-layer mitigations until patching is complete.

An attacker with any valid low-privilege account on a WebCenter Sites instance - such as a content contributor, reviewer, or standard user - sends specially crafted HTTP requests directly to the vulnerable application endpoint. No interaction from an administrator or higher-privileged user is required, and low attack complexity means the exploit does not depend on race conditions or non-standard environmental states. If a patch is reverse-engineered from Oracle's August 2026 CSPU, functional exploit code could be developed by a motivated attacker with moderate skill; no public exploit has been identified at this time.