Oracle WebCenter Sites CVE-2026-61054

No special conditions are required beyond HTTP network access to an Oracle WebCenter Sites instance running version 12.2.1.4.0 or 14.1.2.0.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is feasible without credentials or user interaction against default-accessible deployments. Limiting factors: organizations that restrict WebCenter Sites to internal networks or VPN-only access are not reachable by external attackers; organizations running versions outside 12.2.1.4.0 and 14.1.2.0.0 are not confirmed vulnerable. No specific non-default feature flag, configuration setting, or deployment mode is cited as a prerequisite in the available data.

The CVSS 8.2 score is well-supported by the technical profile: network-accessible via HTTP, no authentication required, no user interaction, and high confidentiality impact - a combination that makes this theoretically exploitable at scale against any exposed WebCenter Sites instance. The authentication bypass tag amplifies practical severity, as attackers need only reach the HTTP endpoint rather than first obtain credentials. No EPSS data was included in the source intelligence, but the AV:N/AC:L/PR:N/UI:N profile typically correlates with higher real-world exploitation probability; even a mid-sized municipal IT team in leszno responsible for an Oracle Fusion Middleware deployment should treat this as urgent given the zero-prerequisite exploitation path. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploit code has been identified at time of analysis, suggesting mass opportunistic exploitation has not yet materialized. The integrity impact is bounded at I:L - attackers can exfiltrate critical data and make limited writes, but availability remains unaffected, which modestly constrains total blast radius.

An unauthenticated attacker with HTTP access to an internet-facing Oracle WebCenter Sites installation sends a crafted request that circumvents the authentication control layer, gaining unauthorized read access to the full dataset accessible by WebCenter Sites - potentially including internal documents, user data, or structured content records. The attacker may additionally perform limited insert, update, or delete operations on a subset of that data. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means skilled attackers could independently develop working exploits from the advisory details alone.