Oracle WebCenter Sites CVE-2026-61042

A valid low-privileged account on the target Oracle WebCenter Sites application is required; the CVSS PR:L metric confirms that unauthenticated exploitation is not supported. The attacker must have network-level HTTP access to the vulnerable instance, making internet-exposed deployments and instances reachable from compromised internal network segments the highest-risk scenarios. Both actively supported version branches (12.2.1.4.0 and 14.1.2.0.0) are affected in their unpatched state, with no non-default configuration identified as a prerequisite - the vulnerability appears to manifest in standard deployments. Exploitation is bounded by the minimum requirement of an authenticated low-privileged session, which prevents purely anonymous remote exploitation but represents a low bar in multi-user CMS environments where contributor or viewer accounts are broadly provisioned.

The CVSS 3.1 score of 8.8 is structurally well-supported: the vector combines network reachability (AV:N), low complexity (AC:L), low privilege (PR:L), no user interaction (UI:N), and full CIA impact with no scope change, producing a consistent high-severity picture. Oracle's advisory language reinforcing 'easily exploitable' further validates the low technical barrier. No EPSS score was supplied in the input data, which is a gap - without it, probabilistic exploitation likelihood cannot be quantified; however, the combination of a broad attack surface (two active version branches), full-takeover impact, and Oracle's own characterization means even a mid-sized municipal IT team in inowroclaw should treat this as urgent if Oracle Fusion Middleware appears in their asset inventory. The absence of a CISA KEV listing and any identified public proof-of-concept moderates the immediate crisis posture somewhat, suggesting exploitation has not yet been observed at scale. The undisclosed CWE is a meaningful intelligence gap: without the root cause class, defenders cannot confidently scope targeted compensating controls and must fall back on patching as the primary mitigation.

An attacker holding a low-privileged Oracle WebCenter Sites account - such as a standard content contributor or authenticated portal user - sends a specially crafted HTTP request to a vulnerable instance running version 12.2.1.4.0 or 14.1.2.0.0. The request triggers the unpatched vulnerability in the WebCenter Sites component, escalating the attacker's access to full system compromise including read and write control over application data and underlying services. No public proof-of-concept has been identified at time of analysis, but Oracle's 'easily exploitable' classification indicates the attack does not require advanced exploitation techniques.