What is the CVSS score of EUVD-2026-37314?

EUVD-2026-37314 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-37314?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity account takeover vulnerability allowing authenticated attackers to fully compromise the product through social…

How to fix or mitigate EUVD-2026-37314?

Within 24 hours: Identify all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 and assess network exposure. Within 7 days: Restrict network access to WebCenter Sites through segmentation, enable multi-factor authentication for all accounts, and issue user awareness training on social engineering threats. Within 30 days: Monitor Oracle security advisories for patch release and begin upgrade planning to unaffected versions.

Oracle WebCenter Sites EUVD-2026-37314

| CVE-2026-46796 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network-reachable HTTP service (AV:N/AC:L), attacker needs a low-privileged account (PR:L), a second user must interact (UI:R), and Oracle states full takeover so C/I/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:59 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with HTTP network access to fully compromise the product when a victim user is tricked into interacting with attacker-supplied content. Oracle rates the flaw 8.0 (high) with confidentiality, integrity, and availability all marked High. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is a Java-based enterprise web experience management (WEM) platform within the Oracle Fusion Middleware stack, used to author, manage, and deliver multi-channel digital content. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers both the 12c (12.2.1.4.0) and 14c (14.1.2.0.0) supported branches. Although CWE classification is N/A in the input, the combination of CVSS metrics (AV:N/AC:L/PR:L/UI:R) and Oracle's 'takeover' language and 'Information Disclosure' tag is consistent with an authenticated client-side flaw such as stored cross-site scripting or CSRF-style request abuse against a higher-privileged operator who interacts with the attacker's payload, leading to session/credential theft or privileged action execution.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 as published at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle distributes WebCenter Sites patches through My Oracle Support and the exact patched build numbers should be taken directly from that CPU page (patch available per vendor advisory; an independently confirmed fix version is not present in the supplied data). Until the CPU is rolled out, restrict the WebCenter Sites authoring/admin UIs to trusted networks via a reverse proxy or VPN, disable or tightly review any self-registration / low-privilege role provisioning so that PR:L access cannot be obtained casually, and remind editors and administrators not to click links or preview untrusted content from low-privileged contributors (this mitigates the UI:R requirement at the cost of slower editorial workflows). Enabling a strict Content-Security-Policy on the WebCenter Sites front-end and reviewing audit logs for suspicious authoring actions from low-privileged accounts are reasonable compensating controls, with the trade-off that aggressive CSP can break legacy templates.