Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-06-16
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an authentication bypass that permits an unauthenticated attacker to acquire fully authorized privileges. Successful exploitation can result in complete takeover of the Oracle WebCenter Sites application, exposing all managed content, configuration data, and potentially the underlying host. The CVSS 3.1 Base Score of 9.8 captures maximum confidentiality, integrity, and availability impact.

Affected Systems

Affected are Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. These releases are part of the Oracle Fusion Middleware suite and are deployed by organizations for web content and collaborative services.

Risk and Exploitability

The CVSS Base Score of 9.8 indicates critical severity. The EPSS score of <1% signals a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited over plain HTTP from any external network, requiring only network access and no authentication. This easy exploitation path increases the feasibility for an attacker.

Generated by OpenCVE AI on June 19, 2026 at 03:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle WebCenter Sites security patch that addresses versions 12.2.1.4.0 and 14.1.2.0.0 as published in the Oracle security advisory.
  • Block or restrict HTTP traffic to the WebCenter Sites server from untrusted or external networks until the patch is applied.
  • Enable comprehensive logging for authentication and request handling, and monitor for anomalous activity that may indicate an exploitation attempt.
  • Configure the application to use HTTPS to mitigate network‑based eavesdropping and manipulation, although patch remains the only complete fix.

Generated by OpenCVE AI on June 19, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 19 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Authentication Bypass in Oracle WebCenter Sites Allowing Application Takeover

Fri, 19 Jun 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Enables Full Takeover of Oracle WebCenter Sites
Weaknesses CWE-287

Fri, 19 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Enables Full Takeover of Oracle WebCenter Sites
Weaknesses CWE-287

Tue, 16 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-06-17T15:10:24.116Z

Reserved: 2026-05-18T15:55:10.299Z

Link: CVE-2026-46799

cve-icon Vulnrichment

Updated: 2026-06-17T15:10:15.257Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-19T03:30:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function