Oracle WebCenter Sites CVE-2026-91552

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, requiring only network reachability of the application's HTTP interface. Limiting factors: exploitation is bounded to confidentiality (read access to WebCenter Sites data) with no integrity or availability impact; the target must be a supported affected version; and exposure is reduced where the WebCenter Sites HTTP interface is not reachable from untrusted networks (e.g., restricted to internal/management segments or behind authentication-enforcing proxies).

All available signals point to a genuine priority rather than an inflated high-CVSS score. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw requiring no user interaction - the easiest possible exploitation profile short of a scope change, and Oracle's own text reinforces this by calling it 'easily exploitable.' The impact is confined to confidentiality (C:H, I:N, A:N): successful attacks yield unauthorized access to critical data or complete read access to all WebCenter Sites data, but no integrity or availability impact, so this is a data-exposure issue rather than a code-execution or destructive one. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at this time; the risk assessment therefore rests on the attacker-favorable CVSS vector plus the typical sensitivity of a content-management platform. Note a labeling tension: the input Tags include 'Authentication Bypass,' but the description and vector describe unauthenticated access to data (C:H only) rather than a documented bypass of an authentication mechanism to gain a session - treat the 'Authentication Bypass' characterization as unverified against the Oracle description. CWE is 'N/A' in the input, so the precise weakness class is unconfirmed.

An unauthenticated attacker who can reach the WebCenter Sites HTTP interface sends a crafted request that exploits the flaw to read sensitive or restricted content managed by the platform. Because no authentication, user interaction, or special privileges are required (AV:N/AC:L/PR:N/UI:N), a single internet- or network-reachable instance of an affected version (12.2.1.4.0 or 14.1.2.0.0) can be targeted directly. No public exploit was identified in the provided data, so an attacker would need to develop or obtain working exploit code.