Oracle WebCenter Sites CVE-2026-61045

No special conditions are required for exploitation: the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against default HTTP-accessible configurations of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0. Any instance reachable over a network via HTTP is exposed regardless of deployment configuration. What limits exploitation in practice is network reachability - if WebCenter Sites is deployed exclusively on internal networks behind a firewall with no internet exposure, external attackers are blocked, though internal threats remain. The vulnerability is not conditional on any non-default feature being enabled, any specific OS platform, or any particular authentication mode being configured.

The CVSS 3.1 score of 8.6 (HIGH) is driven by network attack vector, low complexity, no privileges, and no user interaction - a combination that maximizes exploitability. The confidentiality impact is rated HIGH, meaning full read access to all data within WebCenter Sites scope is possible; integrity and availability are LOW, reflecting partial write access and a partial DoS condition respectively. No EPSS data was provided in the intelligence package, which limits probabilistic exploitation forecasting. Crucially, no CISA KEV listing and no confirmed public POC are present, suggesting exploitation has not yet been observed at scale. Despite this, Oracle's own characterization of the vulnerability as 'Easily exploitable' elevates practical urgency beyond what raw CVSS alone conveys. The attack surface is broad: any internet- or intranet-facing WebCenter Sites installation on the two affected versions is exposed without any compensating authentication requirement. This is not a high-CVSS-but-low-real-risk situation - the PR:N/AC:L profile means opportunistic exploitation is realistic once details are reverse-engineered from Oracle's CPU patch. SSVC inference: Exploitation status is none-publicly-known; automatable = YES (no prerequisites); technical impact = TOTAL on confidentiality - this would likely land in a 'Track Closely / Act Soon' SSVC decision.

An unauthenticated attacker with HTTP network access - whether from the internet or an internal network - sends a specially crafted HTTP request that exploits the authentication bypass flaw, bypassing WebCenter Sites' access controls without supplying any credentials. The attacker then reads all content data accessible within the WebCenter Sites instance, potentially exfiltrating editorial content, configuration data, or user-associated records, and can perform limited data manipulation or cause partial service disruption. No POC is publicly known at time of analysis, but the low complexity and zero-prerequisite nature mean exploitation could be scripted once technical details are inferred from the CPU patch diff.