WebCenter Sites EUVD-2026-61320

Exploitation requires a valid low-privileged account on the target Oracle WebCenter Sites instance, consistent with the CVSS PR:L metric - unauthenticated remote attackers without any valid credentials cannot trigger this vulnerability. Network access to the application over HTTP is required, with no need for user interaction from an administrator or other privileged user once the attacker is authenticated. No special non-default configuration is indicated as a prerequisite; both affected versions are vulnerable in their supported, standard deployment states. Exploitation scope is confined to the WebCenter Sites system itself (S:U), and lateral movement to adjacent Fusion Middleware components would require additional post-exploitation steps beyond this CVE.

The CVSS 8.8 score is well-supported by the vector metrics: the attack is network-accessible, requires low complexity, needs only low-privileged credentials, and demands no user interaction - a combination that significantly lowers the barrier to exploitation. The resulting impact across confidentiality, integrity, and availability is uniformly high, consistent with Oracle's explicit 'takeover' classification. EPSS data is absent from the available intelligence, so probabilistic exploitation likelihood cannot be quantified from that signal. The vulnerability is not listed in the CISA KEV catalog at time of analysis, and no public proof-of-concept exploit has been identified, which moderates urgency relative to actively weaponized CVEs. Nevertheless, the combination of network reachability, low complexity, and full-system-compromise potential means even a mid-sized municipal IT team in walbrzych responsible for a WebCenter Sites deployment should treat this as a critical patching priority, particularly given WebCenter Sites is frequently Internet-facing. Oracle's non-disclosure of the CWE limits precise compensating control design and reduces confidence in workaround effectiveness.

An attacker holding a low-privileged WebCenter Sites account - such as a standard content contributor or reader-level user - sends a specially crafted HTTP request to a vulnerable endpoint within the application, triggering the underlying flaw without requiring any interaction from administrators or other users. Successful exploitation grants the attacker complete control over the WebCenter Sites instance, enabling exfiltration of all managed content, modification or destruction of site data, and potential for further movement within the Oracle Fusion Middleware environment. No public exploit code has been identified at time of analysis, but the low attack complexity rating indicates the vulnerability does not require specialized tooling or deep product knowledge to exploit.