What is the CVSS score of EUVD-2026-37315?

EUVD-2026-37315 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-37315?

Within 24 hours: Immediately identify all WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances in your environment and isolate them from direct internet exposure. Within 7 days: Implement network segmentation restricting access to authorized administrators only, deploy web application firewall (WAF) rules to monitor and block HTTP requests targeting code execution vectors, and enable comprehensive logging and alerting on all WebCenter Sites network traffic. Within 30 days: Monitor Oracle security advisories for patch release; when available, schedule emergency maintenance to apply Critical Patch Update. For instances that cannot be patched, evaluate migration to supported/patched WebCenter Sites versions or decommissioning.

Oracle WebCenter Sites EUVD-2026-37315

| CVE-2026-46797 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Sites Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed WebCenter Sites HTTP endpoint
Delivery

Send crafted unauthenticated HTTP request
Exploit

Trigger vulnerability in WebCenter Sites component
Execution

Gain control of application context
Persist

Exfiltrate content and credentials
Impact

Pivot to Fusion Middleware host

Vulnerability Assessment

Weakness	CWE CWE-284 MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0, requiring only network reachability to the product's HTTP(S) listener (per AV:N/AC:L/PR:N/UI:N). The only practical limiting factors are network exposure of the WebCenter Sites HTTP endpoints (instances behind VPN/WAF that block the affected URI patterns are not reachable) and running one of the two listed supported versions; no user interaction, no authenticated session, and no non-default feature toggle are required.
Impact	All signals point to high real-world risk: CVSS 3.1 base score of 9.8 with vector AV:N/AC:L/PR:N/UI:N reflects a network-reachable, low-complexity, unauthenticated path to full C/I/A impact, and Oracle itself characterizes the issue as 'easily exploitable.' No EPSS score, KEV listing, or public POC is supplied in the input, so exploitation probability data is missing - this means the issue is not yet known to be actively exploited, but Oracle Fusion Middleware CPU advisories with these characteristics are historically reverse-engineered from patches within weeks. The lack of a CWE and the abstract Oracle description are typical of Oracle CPUs and limit detection engineering; treat as priority-one patching despite missing telemetry, rather than waiting for KEV confirmation.
Exploit ScenarioDerived	An internet-positioned attacker scans for the WebCenter Sites HTTP interface (commonly /cs/ContentServer or Satellite Server endpoints) and sends a single crafted unauthenticated HTTP request that triggers the flaw, gaining full control of the WebCenter Sites instance. From there, they pivot to defacing published websites, exfiltrating editorial content and credentials cached in the CMS, or moving laterally into the underlying WebLogic and Fusion Middleware stack. No POC is referenced in the supplied data, but the low-complexity unauthenticated vector makes mass scanning likely once any exploit is published.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Unauthenticated remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing attackers to fully compromise confidentiality, integrity, and availability of the content management platform. Oracle's June 2026 Critical Patch Update advisory rates this 9.8 CVSS and describes it as easily exploitable with no authentication or user interaction. No public exploit identified at time of analysis, but the unauthenticated network vector and high impact place this among the highest-priority items in the CPU.

RemediationAI

Patch available per vendor advisory: apply the WebCenter Sites fixes bundled in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to both the 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle does not publish a distinct fix version string, so apply the CPU patch listed for your installed release. Until patched, restrict HTTP/HTTPS access to WebCenter Sites admin and content delivery endpoints to trusted networks via WAF or reverse-proxy ACLs (trade-off: may block legitimate editor traffic from remote offices), enable logging of unusual POST traffic to /cs/, /webcentersites/, and Satellite Server endpoints, and disable any unused remote management interfaces - generic 'defense in depth' is insufficient given the unauthenticated takeover impact.

Affected VersionsENISA

Oracle WebCenter Sites 12.2.1.4.0

Oracle WebCenter Sites 14.1.2.0.0

Affected Packages

euvd oracle_webcenter_sites no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebCenter Sites is an enterprise web experience management and content publishing platform within Oracle Fusion Middleware, commonly deployed for public-facing marketing and customer portals on WebLogic application servers. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers all current Oracle-supported branches (12.2.1.4.0 and 14.1.2.0.0). Although Oracle did not publish a CWE classification, the combination of HTTP attack vector, no privileges required, and full takeover impact is consistent with classes such as authentication bypass, unsafe deserialization, or unauthenticated server-side injection that have historically affected WebCenter Sites and adjacent Fusion Middleware components.

Know when Oracle Webcenter Sites gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Oracle states unauthenticated HTTP attacker can take over the product, so AV:N/AC:L/PR:N/UI:N with full C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical, unauthenticated remote code execution vulnerability allowing complete compromise of affected content management platforms. No patch is currently available from Oracle, creating immediate operational risk for organizations managing business-critical content, customer data, and web properties through these instances. This represents one of the highest-priority vulnerabilities in Oracle's June 2026 Critical Patch Update.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict affected instances to private networks with access only from authorized systems; (2) WAF deployment-implement rules to detect and block HTTP exploitation attempts; (3) Enhanced monitoring-enable deep packet inspection and alerting on anomalous HTTP payloads; (4) Credential rotation-reset all WebCenter Sites administrative and service account passwords; (5) Backup verification-confirm immutable, offline backups exist. These controls reduce exploitability window but do not eliminate risk; patch application or system replacement is mandatory for remediation.

Threat Intelligence Overview

EPSS Score

0.5%

Top 60% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.