Oracle WebCenter Sites EUVD-2026-37317

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' characterization. The only practical limiting factors are network reachability of the WebCenter Sites HTTP listener (often behind a corporate load balancer or WAF rather than directly internet-facing) and that the target must be running one of the two named versions; no specific feature toggle, non-default mode, or authenticated session is required by the description.

All available signals point to a top-priority vulnerability: the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes the worst realistic profile - remote, low-complexity, unauthenticated, no user interaction, with high impact across CIA. Oracle's own language ('easily exploitable,' 'takeover') reinforces the CVSS picture rather than contradicting it. However, no EPSS score, KEV listing, SSVC decision, or public POC was supplied in the input, so widespread mass-exploitation cannot yet be empirically confirmed - risk should be treated as imminent based on attack surface alone, not on observed in-the-wild activity. The 'Information Disclosure' tag is inconsistent with the description's 'takeover' outcome and should be treated as incomplete metadata rather than a downgrade signal.

An attacker on the internet identifies an exposed Oracle WebCenter Sites instance via banner or path fingerprinting (for example, /cs/Satellite or /sites/ContentServer), then sends a single crafted HTTP request to an unauthenticated endpoint to gain code execution or administrative control. With takeover achieved, the attacker deploys a web shell, harvests stored credentials and content database connection strings, and pivots into the broader Fusion Middleware estate. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language implies reverse-engineering the June 2026 CPU patch is likely to yield a working exploit quickly.