Oracle WebCenter Sites EUVD-2026-37327

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 over HTTP, with no user interaction and no privileges required per CVSS AV:N/AC:L/PR:N/UI:N. Exploitation is limited only by network reachability of the WebCenter Sites HTTP interface, so deployments fronted by an authenticating reverse proxy or restricted to internal networks reduce real-world exposure; there is no availability impact (A:N), so the attack manipulates data rather than taking the service offline.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes an easy-to-exploit, remote, unauthenticated flaw with high confidentiality and integrity impact and no availability impact, consistent with an authentication bypass that grants data access rather than crashing the service. There is no EPSS, KEV listing, or SSVC decision data in the input, and no public exploit identified at time of analysis, so the urgency signal rests entirely on Oracle's own scoring and the Critical Patch Update advisory. The combination of network reach, no privileges, low complexity, the vendor 'Authentication Bypass' tag, and the typical Internet-facing deployment of WebCenter Sites makes this a high-priority patch even without third-party exploitation telemetry; absence of EPSS/KEV data should not be read as low risk, only as missing signals.

An attacker on the Internet sends crafted HTTP requests to an exposed Oracle WebCenter Sites instance, bypassing authentication on a vulnerable endpoint to enumerate and download confidential site content, customer-facing data, and configuration accessible to the application. The same access is then used to create, modify, or delete content objects, enabling defacement of public sites or insertion of malicious links; no public exploit identified at time of analysis, but the CVSS AC:L/PR:N profile implies trivially reproducible exploitation once details are reverse-engineered from the CPU.