What is the CVSS score of EUVD-2026-37317?

EUVD-2026-37317 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-37317?

Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical unauthenticated remote code execution vulnerability (CVSS 9.8) that enables complete system takeover without user…

How to fix or mitigate EUVD-2026-37317?

Within 24 hours: identify and document all Oracle WebCenter Sites instances running 12.2.1.4.0 or 14.1.2.0.0; isolate from production networks if operationally feasible; enable enhanced HTTP request logging and monitoring. Within 7 days: confirm patch status through Oracle Support; implement network segmentation and Web Application Firewall rules restricting access to affected systems. Within 30 days: establish emergency change control procedures with <4-hour patching SLA; monitor Oracle advisory channels weekly for patch availability; prepare rollback strategy.

Oracle WebCenter Sites EUVD-2026-37317

| CVE-2026-46799 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated HTTP-reachable takeover with no user interaction, justifying AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged within the application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully compromise the product via HTTP, per Oracle's June 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability with no privileges or user interaction required, and no public exploit identified at time of analysis. Oracle's own advisory characterizes the flaw as 'easily exploitable,' raising the urgency for affected customers despite the lack of a published CWE classification.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management (WEM) platform within Oracle Fusion Middleware used to author, target, and deliver dynamic web content across customer-facing sites. The affected component is the core 'WebCenter Sites' module itself (CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites), which exposes administrative and content-delivery endpoints over HTTP/HTTPS via an embedded WebLogic or standalone servlet container. Oracle did not publish a CWE, but the combination of unauthenticated network access plus full takeover impact is consistent with deserialization, authentication bypass, or pre-auth injection flaws historically seen in this product family. The tag 'Information Disclosure' from the input is narrower than the stated 'takeover' impact, suggesting the disclosure is one facet of a broader unauthenticated compromise chain.

RemediationAI

Apply the patches released in Oracle's June 2026 Critical Patch Update (CPU) for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, following the matrix and download instructions at https://www.oracle.com/security-alerts/cspujun2026.html - Patch available per vendor advisory, with the specific patch ID listed in the CPU matrix rather than as a single named version. Until patches can be staged, restrict inbound HTTP/HTTPS access to WebCenter Sites administrative and delivery endpoints to a trusted management VLAN or VPN, place a WAF in front with rules blocking anomalous requests to /cs/, /sites/, and Satellite Server paths (accepting the trade-off of false positives on legitimate content authoring), and disable any internet-exposed Satellite Server or remote admin interfaces that are not strictly required. Monitor application and access logs for unauthenticated requests reaching authoring or management URIs as a compensating detection control.