EUVD-2026-106772
GHSA-j32j-mq85-v7vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebCenter Sites HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authorization check
-
ExecutionRead critical application data
-
ImpactExfiltrate sensitive content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated HTTP exploitation against supported default configurations of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, per the vendor description ('easily exploitable,' AV:N/AC:L/PR:N/UI:N). The only practical limiting factor is network reachability: the affected WebCenter Sites HTTP interface must be accessible to the attacker. Impact is limited to confidentiality - unauthorized read access to critical WebCenter Sites data - with no integrity or availability effect, so exploitation discloses data but does not by itself alter or disrupt the system. |
| Impact | Multiple signals converge on a genuine but bounded priority. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an easily exploitable, network-reachable flaw requiring no authentication and no user interaction, which is the most dangerous combination for pre-auth exposure. However, impact is confined entirely to confidentiality (C:H, I:N, A:N) - this is a data-disclosure issue, not code execution or system takeover, which tempers the 7.5 rating. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation; this is a routine Oracle Critical Patch Update (October 2026) disclosure rather than an emergency. One conflict to flag explicitly: the input Tags label this 'Authentication Bypass,' but the Oracle description frames it as unauthenticated access to critical data rather than a bypass of an established auth boundary, and no CWE is assigned - verify the precise vulnerability class against the Oracle CPU advisory before categorizing. Net assessment: patch on a prioritized-but-standard cycle given pre-auth network reachability, while noting the confidentiality-only scope and absence of exploitation evidence keep it below drop-everything urgency. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach an internet-facing or internal Oracle WebCenter Sites instance over HTTP sends a crafted request that the application improperly authorizes, returning critical content-management data the attacker should not be able to read. Because no credentials, user interaction, or special configuration are required (AV:N/AC:L/PR:N/UI:N), the request can be issued directly against a default deployment. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update for WebCenter Sites on versions 12.2.1.4.0 and 14.1.2.0.0, following the vendor advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the source data does not provide a standalone patch version beyond the CPU. If patching cannot be completed immediately, reduce exposure by restricting network access to the WebCenter Sites HTTP interface through firewalls, security groups, or a reverse proxy so only trusted users and integrations can reach it - accepting that this can break legitimate public-facing or partner access. Front the site with a WAF or reverse proxy that enforces authentication or blocks unauthenticated requests to sensitive paths, understanding that generic rules may cause false positives and require tuning. Review WebCenter Sites access logs for unauthenticated requests to administrative, authoring, or data-export endpoints, and disable or block any unused WebCenter Sites components and management interfaces exposed externally.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is a Java-based web experience management and content management platform in Oracle Fusion Middleware, typically exposed over HTTP/HTTPS to deliver public and authenticated web properties. The supplied tag 'Authentication Bypass' and the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicate that unauthenticated network requests can reach data or functionality that should require authentication, resulting in high confidentiality impact with no integrity or availability effect. Oracle's advisory does not name the vulnerable servlet, endpoint, or configuration, and no CWE or CPE strings were supplied in the source data. Because WebCenter Sites commonly fronts content repositories, configuration data, and integrated enterprise systems, exposed deployments should be treated as data-disclosure risks until the CPU is applied.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor description confirms easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N) with high confidentiality-only impact and no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity confidentiality flaw that could expose critical site content and data to network-reachable users. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but the exposure is persistent until containment is in place, creating reputational and compliance risk for teams that publish or manage sensitive content on the platform. Leadership should treat this as a priority containment and monitoring issue because the affected systems may hold regulated or business-critical information.
Restrict network access to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 interfaces to trusted networks or VPN; deploy WAF/reverse-proxy virtual patching to block anomalous content-disclosure requests; enable verbose logging and alerting on access to critical content; segment affected systems; disable unused endpoints and features; apply least privilege; monitor Oracle advisories for a vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB