Oracle WebCenter Sites EUVD-2026-37314

Exploitation requires (1) a valid low-privileged Oracle WebCenter Sites user account (CVSS PR:L) able to reach the application over HTTP, (2) network reachability to the WebCenter Sites web tier, and (3) a separate, higher-privileged user (editor, approver, or administrator) interacting with attacker-supplied content inside the WebCenter Sites UI (CVSS UI:R, 'human interaction from a person other than the attacker'). The vulnerability is limited to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0; instances with no shared authoring workflow, or where low-privileged accounts cannot publish content visible to higher-privileged users, materially reduce real-world exploitability. Scope is Unchanged (S:U), so impact is bounded to the WebCenter Sites application itself rather than the underlying host or other Fusion Middleware components.

This is a high-severity issue (CVSS 8.0) but its real-world risk is bounded by two clear limiting factors visible in the vector: PR:L means the attacker must already hold a low-privileged WebCenter Sites account, and UI:R means a second user must perform an action for the attack to succeed. There is no EPSS score, no CISA KEV listing, no public POC, and no SSVC decision data supplied, so exploitation appears opportunistic rather than imminent - Oracle's CPU notice is the only signal of weaponization potential. Practically, this is a priority patch for organizations whose WebCenter Sites instance hosts authoring workflows shared across roles (editors, approvers, admins), and a lower priority for read-only or single-tenant deployments. Note that 'Information Disclosure' in the tags is narrower than Oracle's own 'takeover' phrasing in the description - defenders should treat the higher-impact interpretation as the planning case until Oracle's CPU detail page clarifies the chain.

A low-privileged contributor account on the targeted WebCenter Sites instance - obtained via phishing, weak self-service signup, or insider access - is used to plant a malicious payload (for example, a crafted asset, template snippet, or workflow comment) and then send a routine 'please review' request to an editor or administrator. When the higher-privileged user opens the item in the WebCenter Sites UI, the payload executes in their authenticated session and the attacker uses that session to perform admin-level actions, escalating to takeover of the WebCenter Sites application. No public exploit identified at time of analysis.