EUVD-2026-79363
GHSA-f4w7-6vpg-q7jf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Sites HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain administrative control
-
ImpactFull product takeover (data read/modify, code execution)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0. The vector (PR:N/UI:N/AC:L) requires no credentials, no user interaction, and no non-default feature to be enabled; the only practical prerequisite is network reachability of the WebCenter Sites HTTP service. The primary limiting factor is exposure: instances restricted to internal networks or behind authenticating reverse proxies/WAFs significantly reduce reachable attack surface. Scope is unchanged (S:U), so impact is confined to the WebCenter Sites instance itself rather than cascading to other trust domains. |
| Impact | This is a genuine high-priority vulnerability whose CVSS 3.1 score of 9.8 is well-calibrated rather than inflated. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a remotely reachable, low-complexity, unauthenticated flaw yielding full product takeover - consistent with the CWE-287 (Improper Authentication) classification and Oracle's own 'takeover' language. Unlike the mislabeled or over-scoped entries common in this Oracle September 2026 CPU batch, the CIA-triad impact here matches the described consequence. That said, several exploitation signals are absent: there is no EPSS probability, no SSVC decision data, no public proof-of-concept, and no CISA KEV listing, so exploitation status is 'no public exploit identified at time of analysis.' The high CVSS reflects worst-case severity and reachability, not confirmed exploitation activity - treat this as urgent to patch given pre-auth RCE-class impact on an internet-facing web platform, but note that actual field exploitation is unconfirmed. Oracle's advisory (cspusep2026.html) provides zero technical detail, a recurring gap for this CPU that prevents independent verification of the attack mechanism. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the WebCenter Sites HTTP interface sends a crafted request that abuses the improper authentication flaw (CWE-287) to bypass access controls and gain administrative control of the instance. Because no authentication, user interaction, or special configuration is required, a single exposed instance can be fully compromised remotely. No public exploit code has been identified at time of analysis, so exploitation would currently require independent vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An authentication bypass in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 enables unauthenticated remote attackers to take over the application via HTTP requests, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The vulnerability sits in the WebCenter Sites component of Oracle Fusion Middleware and requires no credentials, no user interaction and no non-default configuration - only network reachability of the HTTP service - making any internet-exposed instance an immediate target. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), but the trivial attack prerequisites mean exposed deployments should be treated as urgent; instances confined to internal networks or sitting behind an authenticating reverse proxy or WAF have materially reduced reachable attack surface.
RemediationAI
Patch availability: patch available per vendor advisory - Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source and should be applied to the supported releases 12.2.1.4.0 and 14.1.2.0.0; no exact patched build number was supplied in the input data, so confirm the specific release from that advisory before upgrading. Because this is an authentication bypass with PR:N/UI:N and no non-default feature prerequisite, patching should be prioritized ahead of most other pending maintenance on any internet-facing instance. Until the CPU is applied, concrete compensating controls are: place the WebCenter Sites HTTP listener behind an authenticating reverse proxy or WAF and restrict it to trusted source networks or VPN only (side effect: breaks public-site delivery and any unauthenticated content API integrations, so this is only viable for internal deployments); where full exposure is unavoidable, deploy a WAF rule set that enforces authentication or blocks requests that do not carry an established session to administrative and content-management endpoints (side effect: rule tuning is required and bypasses via encoding or parameter pollution are possible, so this is a stopgap, not a fix); segment the WebCenter Sites host so that a compromised instance cannot reach backend databases or adjacent Fusion Middleware services with the same credentials (side effect: requires network changes and may break legitimate integration paths); and enable verbose HTTP access and audit logging with alerting on anomalous unauthenticated requests to administrator, publishing and template-management paths to detect exploitation attempts (side effect: log volume and storage overhead, and detection is retrospective rather than preventive). After patching, rotate any WebCenter Sites administrative, database and integration credentials, since a successful bypass may have allowed credential or session material to be read.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication): WebCenter Sites fails to adequately verify or enforce the identity/authorization state of an incoming request, so a crafted HTTP request can be accepted as already authenticated and yield administrative control of the platform. WebCenter Sites is Oracle Fusion Middleware's web experience management and content management platform used to build and deliver personalized public-facing and intranet sites, which means a bypass typically exposes content repositories, publishing workflows, template code execution surfaces and the administrative console. The CVSS vector confirms scope is unchanged (S:U), so impact is contained within the WebCenter Sites trust domain rather than cascading to unrelated components, and the low attack complexity with no privileges and no user interaction (AC:L/PR:N/UI:N) indicates the bypass is reachable through normal HTTP request handling on stock configurations rather than requiring chained preconditions or a privileged foothold. Customer-specific CPE strings were not supplied in the source data; the authoritative affected identifiers are the product/version tuples reported by the vendor and by ENISA EUVD (EUVD-2026-79363): Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description and CWE-287 support unauthenticated remote HTTP access (AV:N/AC:L/PR:N/UI:N) yielding full product takeover (C:H/I:H/A:H) confined to the instance (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites - the customer-facing web content platform - is exposed to an unauthenticated flaw (CVE-2026-83035, CVSS 9.8) that would let an attacker seize full control of any internet-reachable instance, affecting every user, editor, and downstream system that trusts content served by that platform. No public exploit code or confirmed exploitation has been observed, but the attack requires nothing more than network access to the HTTP service and Oracle has not yet released a fix, so any externally exposed deployment should be treated as an urgent exposure until it is isolated or a patch ships.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet exposure by firewalling inbound HTTP/HTTPS to affected instances; place the service behind an authenticating reverse proxy or WAF with virtual patching for the WebCenter Sites authentication endpoint; restrict reachability to trusted internal networks and administrative jump hosts; enable and monitor access and authentication logs for anomalous or unexpected administrative activity; prioritize an upgrade path for versions outside vendor support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB