EUVD-2026-79365
GHSA-xvqp-vg7g-cjc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable WebCenter Sites HTTP endpoint
-
ExploitSend crafted request bypassing authentication
-
ExecutionGain unauthenticated control of application
-
ImpactAchieve full takeover of confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The only practical prerequisite is network reachability of the WebCenter Sites HTTP interface; no authentication, no user interaction, and no non-default feature or configuration is required. The primary limiting factor is exposure scope: instances restricted to internal networks or behind a WAF/reverse proxy that filters the (undisclosed) vulnerable request path significantly reduce attacker reach. Oracle discloses no component-specific gating condition. |
| Impact | This is a genuine high-priority vulnerability, and the CVSS 9.8 rating is well-calibrated rather than inflated. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, unauthenticated (PR:N), low-complexity exploitation over HTTP that yields full 'takeover' of the product (complete C/I/A loss), and CWE-287 (Improper Authentication) is consistent with the 'Authentication Bypass' tag and Oracle's own 'unauthenticated attacker' language. All signals align - there is no contradiction between the description and the vector. However, several exploitation-priority signals are simply MISSING rather than negative: no EPSS score is provided, KEV status is not listed (treat as not KEV / no confirmed active exploitation), no public POC is referenced, and no SSVC decision data is supplied. Oracle's advisory (cspusep2026) provides zero technical detail on the flaw mechanism, so exploitability in practice cannot be independently validated from vendor data. Net: prioritize patching due to pre-auth full-takeover potential in an enterprise-exposed web product, but note that real-world exploitation frequency cannot be confirmed from the available intelligence - the urgency rests on the intrinsic severity and pre-auth reachability, not on evidence of exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the WebCenter Sites HTTP interface sends a crafted request that bypasses authentication (CWE-287), gaining full control of the WebCenter Sites instance and its content/data. Because no privileges, user interaction, or special configuration are required (PR:N/UI:N/AC:L), the attack is straightforward against any network-reachable instance. No public exploit code is identified at time of analysis, and there is no evidence of active exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can achieve full takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 through an authentication bypass reachable over HTTP, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector that drives the 9.8 base score. No authentication, user interaction, or non-default configuration is required - the only practical prerequisite is network reachability of the WebCenter Sites HTTP interface, which means internet-exposed authoring or delivery instances carry the highest risk. The flaw is rated CWE-287 (Improper Authentication), and at time of analysis there was no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); Oracle has published a Critical Security Patch Update advisory covering the affected versions.
RemediationAI
Apply the Oracle Critical Security Patch Update referenced in the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html - patch availability is confirmed per vendor advisory, but no exact fixed build number is disclosed in the available intelligence, so consult the advisory itself for the precise WebCenter Sites patch for 12.2.1.4.0 and 14.1.2.0.0 rather than relying on a version number inferred here. Because exploitation requires only network reachability of the HTTP interface, prioritize patching any instance that is internet-facing or reachable from untrusted network segments. Until patching is complete, reduce exposure by placing WebCenter Sites behind a reverse proxy or load balancer and restricting access to the authoring/administrative interfaces to trusted source ranges - the trade-off is that public content delivery will also need explicit allow-listing, which can disrupt legitimate visitor traffic if scoped too aggressively. Deploying WAF rules is a weaker control here: Oracle has not disclosed the vulnerable request path, so any signature is speculative and may produce false negatives; treat WAF filtering as defense-in-depth only, not as a substitute for the patch. Additional compensating measures include network segmentation to limit lateral movement from a compromised WebCenter Sites host, enhanced logging and alerting on anomalous unauthenticated requests to the application, and disabling or de-registering any WebCenter Sites endpoints that are not operationally required, accepting the loss of that functionality as the cost. Monitor Oracle's advisory page for updated guidance, since delayed patch publication for some supported versions is common in Oracle's quarterly cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Sites is a Java EE web content management and digital experience platform shipped as part of Oracle Fusion Middleware, typically fronted by an HTTP listener and used for both content authoring and public site delivery. The vulnerability is classified as CWE-287 (Improper Authentication), meaning the component fails to correctly verify or enforce an authentication decision, allowing a remote request to reach functionality that should be gated behind a login. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact under an unchanged scope (S:U), the bypass is exploitable in a single unauthenticated HTTP exchange and can compromise the application service itself rather than a strictly sandboxed subcomponent. Oracle's advisory does not disclose the specific request path, parameter, or authentication mechanism involved, so signature-level detection is difficult and operators should treat the entire WebCenter Sites HTTP surface as suspect until patched. The affected EUVD-recorded versions are Oracle WebCenter Sites 14.1.2.0.0 and 12.2.1.4.0; the advisory is published as part of Oracle's Critical Security Patch Update program.
Know when Webcenter Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable, unauthenticated HTTP-based full takeover (AV:N/AC:L/PR:N/UI:N), yielding complete C/I/A loss within the product scope (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 carry a critical authentication bypass (CVE-2026-83037, CVSS 9.8) that allows an unauthenticated attacker with network access to seize full control of an affected instance. Because no credentials or user interaction are required, any internet-exposed authoring or delivery deployment represents an immediate enterprise risk to content integrity, hosted data, and any downstream systems that trust the platform. At time of analysis no public exploit code and no confirmed active exploitation have been identified (not listed in CISA KEV), giving leadership a narrow but real window to contain exposure before attacks emerge.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately remove internet exposure of the WebCenter Sites HTTP interface and restrict access to trusted networks, VPN, or IP allowlists; place authoring and delivery instances behind network segmentation with strict east-west controls; deploy WAF rules to detect and block anomalous authentication requests; disable or firewall unused endpoints and administrative interfaces; enable and monitor authentication and access logging with alerting on bypass indicators; rotate credentials and service accounts associated with the platform and its integrations; and pursue an Oracle support case for a fixed release or one-off patch through the Critical Security Patch Update advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Portal
View allXStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.9), this vulnerabi
XStream is software for serializing Java objects to XML and back again. Rated high severity (CVSS 8.8), this vulnerabili
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.1), this vulnerabi
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 8.6), this vulnerability
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
XStream is a Java library to serialize objects to XML and back again. Rated high severity (CVSS 7.5), this vulnerability
XStream is a Java library to serialize objects to XML and back again. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB