EUVD-2026-79361
GHSA-7vwv-j662-pjv7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible HTTP flaw with low complexity and no user interaction, but gated on a low-privileged account, so PR:L and all-high impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged account on the target Oracle WebCenter Sites deployment (CVSS PR:L) and network reachability to the WebCenter Sites HTTP interface (AV:N); no user interaction is required and attack complexity is low. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 is driven by network vector, low attack complexity and no user interaction, offset by the requirement for low privileges (PR:L) - this is not a pre-auth flaw, so an internet-exposed instance is not automatically exploitable by an anonymous attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle's fix is published in the Critical Security Patch Update for this cycle - the advisory at https://www.oracle.com/security-alerts/cspusep2026.html should be treated as the authoritative source; the input does not include an exact patch version string, so apply the WebCenter Sites patch bundle cited there for 12.2.1.4.0 and 14.1.2.0.0 (patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today