Oracle WebCenter Sites EUVD-2026-46912

Exploitation requires only network reachability to the WebCenter Sites HTTP interface: per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication (PR:N), no user interaction (UI:N), and low complexity apply - i.e., no special conditions beyond HTTP access to a default deployment of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0. What LIMITS exploitation is exposure: the instance must be reachable by the attacker, so deployments restricted to internal networks, VPNs, or IP-allowlisted management interfaces are far harder to reach, and only the two named supported versions are stated as affected. The impact is confined to confidentiality (data disclosure) - integrity and availability are unaffected (I:N/A:N) - so this cannot by itself be used to modify data or cause outages.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6 High) describes an easily exploitable, network-reachable, unauthenticated attack with no user interaction and a scope change - signals that favor prioritization for any internet-exposed instance. However, the impact is strictly confidentiality (I:N/A:N): no data tampering or denial of service, so this is a data-exposure risk, not an RCE or integrity threat. Real-world exploitation signals are weak-to-absent: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC was referenced, suggesting no known widespread exploitation yet. The Oracle 'Authentication Bypass' tag is consistent with the PR:N metric but is a vendor label rather than an independent technical confirmation. Net: treat as a genuine high priority where WebCenter Sites is internet-facing due to the pre-auth network vector, but the confidentiality-only impact and lack of exploitation evidence place it below actively-exploited RCEs in the same Oracle CPU.

An attacker who can reach a WebCenter Sites instance over HTTP sends crafted requests that bypass authentication/authorization and retrieve content and data the application protects, without any credentials or user interaction. Because of the scope change, the attacker may pivot the access to read data managed by additional integrated products. No public POC was referenced, so this reflects the CVSS-derived attack profile rather than a demonstrated exploit.