EUVD-2026-79362
GHSA-7587-xc2v-9q32
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable HTTP request with no complexity or interaction, producing confidentiality-only impact, matching Oracle's stated vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthenticated attackers with HTTP network access to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 can read data they should not be able to reach, including potentially all content and data the application can access. Oracle rates it 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), meaning no credentials, no user interaction and no special complexity are needed - only reachability to the web interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the WebCenter Sites HTTP interface of an affected installation (12.2.1.4.0 or 14.1.2.0.0) - the CVSS vector is PR:N/UI:N, so no credentials, session, or victim interaction are needed for unauthenticated request submission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point the same direction: this is a low-effort, unauthenticated, network-reachable data-disclosure flaw, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) maps cleanly onto the description's claim of an 'easily exploitable' issue, so there is no vector-versus-narrative conflict to reconcile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in https://www.oracle.com/security-alerts/cspusep2026.html - this is the only vendor-sanctioned fix, and because the advisory does not publish a discrete patch version number in the supplied data, treat the CPU/CSPU bundle for the applicable 12.2.1.4.0 or 14.1.2.0.0 release as the target and verify against Oracle's patch availability table before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today