What is the CVSS score of EUVD-2026-37327?

EUVD-2026-37327 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-37327?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain an unauthenticated remote authentication bypass that enables attackers to read, create, modify, and delete all application data…

How to fix or mitigate EUVD-2026-37327?

Within 24 hours: Conduct inventory of all Oracle WebCenter Sites instances; identify which run versions 12.2.1.4.0 or 14.1.2.0.0 and classify data sensitivity levels. Within 7 days: Implement firewall/WAF rules restricting WebCenter Sites network access to trusted internal networks only; enable comprehensive authentication and data-access logging; escalate with Oracle support for patching timeline and interim guidance. Within 30 days: Apply vendor patch to all affected systems immediately upon release; conduct post-patch validation and penetration testing to confirm remediation.

Oracle WebCenter Sites EUVD-2026-37327

| CVE-2026-46809 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Sites

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Description states unauthenticated HTTP exploitation with full read and create/modify/delete of all accessible data and no availability impact, matching AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:52 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible via HTTP, allowing attackers to read, create, modify, or delete all data accessible to the application. Oracle rates this as easily exploitable with no privileges or user interaction required (CVSS 9.1), and no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass affecting the WebCenter Sites component of Oracle Fusion Middleware.

Technical ContextAI

Oracle WebCenter Sites is a Java-based web experience and content management platform within Oracle Fusion Middleware, typically deployed on WebLogic and used to publish public-facing marketing sites and digital experiences. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_sites identifies the application itself, and the vendor tag 'Authentication Bypass' indicates the root cause is a failure to properly enforce authentication on an HTTP-reachable interface, which is conceptually aligned with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function), though the input lists CWE as N/A. Because WebCenter Sites is typically Internet-facing for content delivery and management, an authentication bypass exposes content APIs, administrative actions, and stored data directly to anonymous HTTP clients.

RemediationAI

Apply the patch available per vendor advisory by installing the fixes shipped in the Oracle Critical Patch Update of June 2026 at https://www.oracle.com/security-alerts/cspujun2026.html for both Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0; Oracle does not publish an independent fixed build number, so the CPU itself is the authoritative reference. Until the CPU can be applied, restrict HTTP access to WebCenter Sites management and delivery endpoints to trusted networks via a WAF or reverse proxy ACL and disable any externally reachable admin or content APIs that are not strictly required, accepting that this may break content authoring workflows and external integrations and is not a substitute for the patch. Monitor WebCenter Sites and fronting web server logs for anonymous HTTP requests to content or admin paths that return successful responses without a prior authenticated session, as these would be consistent with exploitation of an authentication bypass.