Oracle WebCenter Sites CVE-2026-91240

Exploitation targets Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 reachable over HTTP; no authentication is required (PR:N) and no user interaction is needed (UI:N). The principal limiting factor is high attack complexity (AC:H): success depends on conditions the attacker does not control - likely specific server state, timing, or non-deterministic factors - so exploitation is not reliably repeatable. Impact is confined to confidentiality (unauthorized read access to critical or all application-accessible data); the flaw does not, by the CVSS vector, permit data modification (I:N) or service disruption (A:N). Exposure is further limited to organizations running WebCenter Sites with the HTTP interface reachable by the attacker (e.g., internet-facing or otherwise network-accessible deployments).

The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) describes a remotely reachable, unauthenticated (PR:N) flaw over HTTP, but with high attack complexity (AC:H) and impact limited strictly to confidentiality (C:H, I:N, A:N) - meaning data disclosure, not takeover or tampering. The AC:H rating signals that successful exploitation requires conditions outside the attacker's control (e.g., winning a race, specific state, or non-deterministic factors), which materially lowers real-world exploitability despite the network/unauthenticated profile. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but moderate-priority issue: patch in a normal Oracle CPU cycle rather than as an emergency. Note a conflict to verify: the input Tags include 'Authentication Bypass', yet the description and CVSS characterize the flaw as unauthorized data access with confidentiality-only impact (not integrity/privilege change) - treat the 'Authentication Bypass' label with caution and verify against the Oracle CPU advisory.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet-facing Oracle WebCenter Sites instance (12.2.1.4.0 or 14.1.2.0.0), exploiting the flaw to read critical content and potentially all data accessible to the application. Because the CVSS vector sets AC:H, the attack is not reliably repeatable and may depend on timing or server state, so exploitation is difficult rather than point-and-click. No public exploit code was identified in the provided data.