What is the CVSS score of EUVD-2026-37315?

EUVD-2026-37315 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-37315?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical, unauthenticated remote code execution vulnerability allowing complete compromise of affected content management…

How to fix or mitigate EUVD-2026-37315?

Within 24 hours: Immediately identify all WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances in your environment and isolate them from direct internet exposure. Within 7 days: Implement network segmentation restricting access to authorized administrators only, deploy web application firewall (WAF) rules to monitor and block HTTP requests targeting code execution vectors, and enable comprehensive logging and alerting on all WebCenter Sites network traffic. Within 30 days: Monitor Oracle security advisories for patch release; when available, schedule emergency maintenance to apply Critical Patch Update. For instances that cannot be patched, evaluate migration to supported/patched WebCenter Sites versions or decommissioning.

Oracle WebCenter Sites EUVD-2026-37315

| CVE-2026-46797 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP attacker can take over the product, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:58 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the content management platform. Oracle's June 2026 Critical Patch Update advisory rates this 9.8 CVSS and describes it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, but the unauthenticated network vector and high impact place this among the highest-priority items in the CPU.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management and content publishing platform within Oracle Fusion Middleware, commonly deployed for public-facing marketing and customer portals on WebLogic application servers. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers all current Oracle-supported branches (12.2.1.4.0 and 14.1.2.0.0). Although Oracle did not publish a CWE classification, the combination of HTTP attack vector, no privileges required, and full takeover impact is consistent with classes such as authentication bypass, unsafe deserialization, or unauthenticated server-side injection that have historically affected WebCenter Sites and adjacent Fusion Middleware components.

RemediationAI

Patch available per vendor advisory: apply the WebCenter Sites fixes bundled in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to both the 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not publish a distinct fix version string, so apply the CPU patch listed for your installed release. Until patched, restrict HTTP/HTTPS access to WebCenter Sites admin and content delivery endpoints to trusted networks via WAF or reverse-proxy ACLs (trade-off: may block legitimate editor traffic from remote offices), enable logging of unusual POST traffic to /cs/, /webcentersites/, and Satellite Server endpoints, and disable any unused remote management interfaces - generic 'defense in depth' is insufficient given the unauthenticated takeover impact.