Oracle WebCenter Sites EUVD-2026-79359

Requires a low-privileged authenticated account (CVSS PR:L) on Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 with network HTTP reachability to the vulnerable component; no user interaction is needed. The limiting factor is that valid low-privilege credentials (or an obtainable low-privilege session) are a prerequisite - this is not pre-auth - but no non-default configuration or special feature toggle is documented as required. The scope change (S:C) means a successful compromise can affect additional co-located Fusion Middleware/WebLogic products, raising real impact beyond the Sites application itself. Oracle's CPU discloses no specific endpoint or setting, so the precise triggering feature cannot be named from available data.

This is a genuine high-priority vulnerability with a well-calibrated CVSS 9.9. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes remote (AV:N), low-complexity (AC:L) exploitation requiring only low privileges (PR:L) with no user interaction, yielding a full confidentiality/integrity/availability compromise plus a scope change (S:C) - meaning the blast radius extends beyond WebCenter Sites into adjacent products (typically the underlying WebLogic/Java stack that Fusion Middleware shares). Unlike many inflated Oracle scores, the 9.9 here is honestly justified: PR:L (not PR:N) and S:C together with the full impact triad are internally consistent. No exploitation-probability enrichment is available: EPSS is absent, the CVE is NOT in CISA KEV, and no public POC is identified - so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. No SSVC decision framework data was provided. The main tension is a metadata one: the input tag 'Information Disclosure' understates a full-takeover (C:H/I:H/A:H) issue - treat this as a takeover, not merely a read primitive. Oracle's CPU advisory (cspusep2026) provides zero technical detail (no endpoint, parameter, CWE, or root cause), which caps confidence on the exact exploitation path. Net: prioritize patching for any exposed WebCenter Sites instance where a low-privileged account is obtainable, but note that the low real-world footprint of this product tempers organization-wide urgency relative to the sibling WebLogic 10.0 flaw in the same CPU.

An attacker holding any low-privileged authenticated account on an internet- or intranet-reachable WebCenter Sites instance sends crafted HTTP requests to a vulnerable component endpoint, escalating to full control of the application. Because CVSS marks a scope change, the compromise can pivot into adjacent Fusion Middleware/WebLogic components running under the same runtime, extending impact beyond Sites itself. No public exploit code has been identified, and Oracle's CPU discloses no technical detail, so exploitation currently requires original research.