Skip to main content

Oracle WebCenter Sites EUVDEUVD-2026-61306

| CVE-2026-61016 HIGH
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-543q-mgg8-qwmc
Authentication Bypass Denial Of Service Oracle Webcenter Sites
8.2
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
vuln.today AI
8.2 HIGH

Network HTTP attack requiring no authentication, with high integrity impact from full data manipulation and low availability from partial DOS; confidentiality unaffected per advisory.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 04:15 vuln.today
CVE Published
Aug 18, 2026 - 21:16 nvd
HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).

AnalysisAI

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 via HTTP. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 8.2 is well-supported by the AV:N/AC:L/PR:N/UI:N vector, which together signal a straightforward, unauthenticated network attack requiring no user involvement - a profile that genuinely warrants high-priority remediation rather than being a case of inflated scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Administrators should apply the relevant patches from the Oracle August 2026 Critical Patch Update immediately, available at https://www.oracle.com/security-alerts/cspuaug2026.html, for Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Oracle WebCenter Sites deployments (versions 12.2.1.4.0 and 14.1.2.0.0), verify network accessibility, and document instances accessible over HTTP. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Webcenter Sites

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2015-3253 CRITICAL
9.8 Aug 13

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
CVE-2021-45105 MEDIUM
5.9 Dec 18

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
CVE-2021-29505 HIGH POC
8.8 May 28

XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2019-2578 HIGH POC
8.6 Apr 23

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CVE-2018-2791 HIGH POC
8.2 Apr 19

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated hig
CVE-2020-5258 HIGH POC
7.7 Mar 10

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Rated high severit
CVE-2020-7226 HIGH POC
7.5 Jan 24

CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excess
CVE-2019-5427 HIGH POC
7.5 Apr 22

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect
CVE-2013-4316 CRITICAL
10.0 Sep 30

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack v
CVE-2018-3238 MEDIUM POC
6.9 Oct 17

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Rated med
CVE-2020-11023 MEDIUM POC
6.1 Apr 29

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-61306 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy