What is the CVSS score of EUVD-2026-46912?

EUVD-2026-46912 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by EUVD-2026-46912?

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain an authentication bypass enabling remote, unauthenticated attackers to access all data managed by the platform.

How to fix or mitigate EUVD-2026-46912?

Within 24 hours, inventory all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 and categorize by data sensitivity. Within 7 days, implement network-level compensating controls: restrict HTTP access via firewalls or Web Application Firewall rules, disable non-critical features if operationally feasible, and enable detailed access logging. Within 30 days, coordinate with Oracle support to understand patch timelines, conduct risk assessment of systems connected to WebCenter Sites that could be affected by scope-change exploitation, and develop an upgrade roadmap-escalate to procurement if infrastructure replacement is required.

Oracle WebCenter Sites EUVD-2026-46912

| CVE-2026-60550 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qp7c-7p9f-vcrr

Authentication Bypass Oracle Webcenter Sites

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated HTTP-reachable auth bypass gives AV:N/AC:L/PR:N/UI:N; scope change (S:C) and confidentiality-only disclosure give C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:43 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience/content management (WCM) platform within Oracle Fusion Middleware, typically deployed on WebLogic Server and fronting public-facing corporate websites. The Oracle-supplied tag 'Authentication Bypass' combined with the CVSS metrics (PR:N, no integrity or availability impact, high confidentiality) points to a root cause where an authorization or session/access-control check can be circumvented over HTTP, exposing protected content and data. No CWE was assigned in the input (CWE: N/A), so the precise weakness class is not formally categorized, but the signature is consistent with broken access control / improper authentication in a request-handling component. The scope change (S:C) indicates the vulnerable component can be leveraged to access resources managed by other components or products it integrates with.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) of July 2026, which contains the fix for this issue - see https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle applicable to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 (patch available per vendor advisory; a discrete fixed build number was not provided in the input, so identify the specific patch ID from the CPU matrix). Until patching, reduce exposure by restricting network access to the WebCenter Sites HTTP endpoints - place the application behind a VPN or IP allowlist, block direct internet access to management and content-delivery URLs at the load balancer or WAF, and monitor for anomalous unauthenticated access to protected content paths; note these controls can break legitimate public-website delivery if the site is intentionally internet-facing, so scope them to administrative and non-public interfaces where possible. Because the scope is changed, also review and tighten trust between WebCenter Sites and any integrated Oracle products it can reach.