Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-07-21
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle WebCenter Sites allows attackers who can reach the application over HTTP to gain access without authentication. The vulnerability, categorized as CWE‑200, enables an unauthenticated actor to read protected data or, in the worst case, all content stored in the application, thereby compromising confidentiality.

Affected Systems

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 are affected. Because the flaw changes the security scope, other components in the same environment could be impacted by a successful exploitation.

Risk and Exploitability

The CVSS 3.1 base score of 8.6 highlights serious confidentiality damage, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved from any network that can reach the HTTP interface, requiring no credentials or user interaction.

Generated by OpenCVE AI on August 2, 2026 at 21:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Critical Patch Update for version 12.2.1.4.0 or 14.1.2.0.0, or upgrade to a newer release containing the fix
  • Disable or block HTTP access to WebCenter Sites, and enforce TLS so that only secure connections are accepted
  • Restrict exposure of the WebCenter Sites application to trusted networks or internal hosts through firewall rules or network segmentation
  • Implement least‑privilege access controls for all WebCenter Sites accounts and services, and monitor logs for anomalous activity

Generated by OpenCVE AI on August 2, 2026 at 21:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Exposure via HTTP in Oracle WebCenter Sites

Tue, 28 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Vulnerability Allowing Unauthorized Data Access in Oracle WebCenter Sites
Weaknesses CWE-284

Mon, 27 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Vulnerability Allowing Unauthorized Data Access in Oracle WebCenter Sites
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-27T11:29:15.272Z

Reserved: 2026-07-08T15:51:40.544Z

Link: CVE-2026-60556

cve-icon Vulnrichment

Updated: 2026-07-27T11:29:07.579Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T22:00:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor