Oracle WebCenter Sites EUVD-2026-37316

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 over HTTP, with no user interaction required (PR:N, UI:N, AC:L, AV:N). The only meaningful limiting factor is network reachability of the Sites HTTP endpoints from the attacker's position: deployments where Sites is exposed only to an internal management VLAN, fronted by an authenticating reverse proxy, or restricted by IP allowlisting materially reduce real-world exposure, while internet-facing or DMZ-published Sites instances are exploitable as-shipped.

All available signals point to a top-tier priority. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0 score: remote, low-complexity, unauthenticated, no user interaction, with full confidentiality, integrity, and availability impact and a scope change. KEV status is not listed and no EPSS score is provided in the input, and no public POC is referenced - so widespread exploitation cannot currently be asserted. The Oracle-supplied tag 'Information Disclosure' conflicts with the description's 'takeover' wording and C:H/I:H/A:H impact; the CVSS metrics and description should be treated as authoritative over the tag. Despite the absence of confirmed in-the-wild abuse, the combination of unauthenticated network reachability, low complexity, scope change, and Oracle's own characterisation as 'easily exploitable' makes this a same-day patching candidate for any internet-facing or untrusted-network-reachable deployment.

An attacker who can reach the WebCenter Sites HTTP listener - typically the application-server port behind a public web tier - sends a single crafted HTTP request to a vulnerable Sites endpoint without supplying any credentials. The flaw yields full takeover of the WebCenter Sites instance, and because the issue carries a scope change, the attacker can pivot to affect the underlying application server or integrated content/identity systems, planting backdoored templates or harvesting managed content. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording suggests a working exploit is likely to surface quickly after patch diffing.