EUVD-2026-37319Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify internet-exposed WebCenter Sites host
-
DeliveryFingerprint version 12.2.1.4.0 or 14.1.2.0.0
-
ExploitSend crafted unauthenticated HTTP request
-
InstallTrigger vulnerable WebCenter Sites handler
-
C2Gain code or admin context on application
-
ExecutePivot into WebLogic/Fusion Middleware
-
ImpactExfiltrate content and tamper with published site
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites is in scope, since CVSS is AV:N/AC:L/PR:N/UI:N and Oracle explicitly characterizes the flaw as easily exploitable by an unauthenticated attacker over HTTP. Realistic limiting factors are: the target must be running WebCenter Sites version 12.2.1.4.0 or 14.1.2.0.0 specifically, the HTTP/HTTPS listener for WebCenter Sites must be reachable from the attacker (so instances behind VPN, internal-only, or with WAF/ACL restrictions on admin URIs are harder to reach), and Oracle has not disclosed which specific endpoint or component is vulnerable, so attackers need that detail (likely to emerge after the CPU advisory is parsed) before broad exploitation is practical. |
| Impact | All CVSS 3.1 signals point to maximum urgency: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and C:H/I:H/A:H, giving the published 9.8 score and matching Oracle's own 'easily exploitable' and 'takeover' language. Counter-signals are weaker than usual - there is no public exploit identified at time of analysis, no CISA KEV listing, no EPSS value supplied, and no CWE - so widespread automated exploitation is not yet evidenced even though the bug class clearly supports it. Net assessment: a real priority, not a high-CVSS-but-low-risk paper finding, especially for internet-exposed WebCenter Sites instances; the absence of CWE and POC data is a gap that should be tracked but does not lower the patching urgency. |
| Exploit ScenarioDerived | An attacker scans the internet for Oracle WebCenter Sites instances on HTTP/HTTPS and sends a single crafted unauthenticated request to a vulnerable endpoint on 12.2.1.4.0 or 14.1.2.0.0, achieving full takeover of the WebCenter Sites application and the content it manages. From that foothold they pivot to read or modify published web content, exfiltrate editorial and customer data, and use the underlying WebLogic process as a stepping stone into the broader Fusion Middleware environment. No public exploit identified at time of analysis, but the AC:L / PR:N / UI:N vector means weaponization is straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with the vendor and CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) characterizing the flaw as easily exploitable and yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, the issue is not on the CISA KEV list, and no EPSS score was provided, but the 9.8 base score plus Oracle's 'takeover' wording make this a top-tier patching priority on the Oracle Critical Patch Update cycle.
RemediationAI
Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0; Oracle does not publish a separate point release identifier in the description, so track the CPU patch number from the advisory for change management. Until patching is complete, restrict HTTP/HTTPS access to WebCenter Sites delivery and administration endpoints to trusted networks via firewall or reverse-proxy ACLs (trade-off: may break external content delivery and remote authoring), block or rate-limit anonymous access to management URIs at a WAF (trade-off: risk of bypass if signatures are imprecise), and increase monitoring of WebLogic/WebCenter Sites access logs for unauthenticated POSTs to admin and content APIs. Do not rely on disabling unused features as the description does not name a specific component switch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is the Java-based web experience management / content delivery platform within Oracle Fusion Middleware, typically deployed on WebLogic and reachable through HTTP/HTTPS for content delivery, preview, and administrative consoles. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers the affected product, and EUVD enumerates the impacted releases as 12.2.1.4.0 and 14.1.2.0.0. Oracle did not publish a CWE, so the root cause class is not formally categorized, but the combination of unauthenticated HTTP exploitation and full system takeover is consistent with the deserialization, template-injection, or authentication-bypass bug classes historically seen in WebCenter Sites and other Fusion Middleware components.
Know when Oracle Webcenter Sites gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated HTTP exploitation is easy and results in product takeover, so AV:N, AC:L, PR:N, UI:N, S:U with full C/I/A impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated remote takeover vulnerability (CVSS 9.8) enabling complete system compromise via HTTP. With no vendor patch currently available, affected systems remain in an unmitigated security state. Organizations must immediately identify deployed instances and implement emergency containment measures to prevent full system breach.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict inbound HTTP/HTTPS access to WebCenter Sites servers via firewall rules and network segmentation to authorized sources only; deploy web application firewall (WAF) rules to monitor and block suspicious HTTP traffic patterns; enable continuous system logging and security event monitoring for exploitation indicators; maintain isolated offline backups for rapid recovery; if operationally feasible, consider temporary system shutdown until patch is available. These controls reduce attack surface but do not eliminate risk.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Webcenter Sites
View allRemote unauthenticated takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP, with a maximu
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated network attackers ove
Remote takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to
Unauthenticated remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing attac
Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated attackers over HTTP,
Remote code execution and full product takeover affects Oracle WebCenter Sites 14.1.2.0.0 within Oracle Fusion Middlewar
Unauthenticated remote compromise of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing att
Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged remote attacker with HTTP a
Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker with
Takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible when a low-privileged attacker with HTTP networ
GitHub PoC
Exploit-DB