What is the CVSS score of EUVD-2026-37422?

EUVD-2026-37422 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-37422?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability that enables low-privileged users to completely compromise the system, including unauthorized data access…

How to fix or mitigate EUVD-2026-37422?

Within 24 hours: Identify all Oracle WebCenter Sites instances running versions 12.2.1.4.0 or 14.1.2.0.0; restrict new user account creation and limit network access to trusted IP ranges. Within 7 days: Audit active user accounts for unnecessary low-privilege assignments, implement detailed application logging, and establish alerts for suspicious authentication patterns. Within 30 days: Develop upgrade plan for newer Oracle WebCenter Sites versions and monitor for vendor patch release; deploy any available patch immediately upon release.

Oracle WebCenter Sites EUVD-2026-37422

| CVE-2026-35295 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable HTTP interface (AV:N), low-tier account required (PR:L), non-default conditions needed (AC:H), no user interaction, and vendor describes full instance takeover (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible when a low-privileged attacker with HTTP network access successfully chains a high-complexity exploit path in the WebCenter Sites component, resulting in full confidentiality, integrity, and availability compromise. Oracle's June 2026 Critical Patch Update disclosure rates this CVSS 7.5 with AC:H/PR:L, meaning a valid (even low-tier) account plus non-trivial conditions are required. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is a Java-based web experience management (WCM) platform within Oracle Fusion Middleware used to author, manage, and deliver dynamic web content; it exposes administrative and delivery interfaces over HTTP/HTTPS and integrates with Oracle WebLogic Server. The affected CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_sites covers all builds of the 12.2.1.4.0 and 14.1.2.0.0 release trains. No CWE is published by Oracle for this CVE, which is typical of Oracle CPU disclosures; the 'takeover' language combined with full C/I/A impact at unchanged scope suggests an authenticated logic, deserialization, or injection flaw in a WebCenter Sites HTTP-reachable endpoint rather than a pre-auth bug, but the exact root-cause class is not disclosed by the vendor.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle does not publish individual fix build numbers in CVE text, so use the CPU patch IDs listed in the advisory matrix and the My Oracle Support note it references. Until patches are applied, restrict HTTP/HTTPS access to the WebCenter Sites admin and contributor interfaces to trusted networks via WAF or reverse-proxy ACLs (trade-off: blocks legitimate remote editors), tighten provisioning so that low-privileged accounts are not handed out broadly and audit existing low-tier accounts for disuse (trade-off: operational overhead, may delay onboarding), and enable detailed access logging on the Sites servlet endpoints to detect anomalous requests from authenticated users. Generic 'defense in depth' is not sufficient here because PR:L means any existing low-tier account is a potential exploit vehicle.