The reported flaw within Oracle WebCenter Sites permits a low‑privileged attacker who can reach the application over HTTP to exercise control over the platform. The vulnerability stems from insufficient authentication and authorization controls that allow the attacker to access administration functions. Successful exploitation results in full site takeover, compromising all data stored within the system and disrupting public service.

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 are affected. These versions are part of the Oracle Fusion Middleware stack and are commonly deployed in intranet and internet facing web portals.

The CVSS v3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact. The EPSS score is not available, but the vulnerability is described as easily exploitable and requires only network access over HTTP. It is not listed in the CISA KEV catalog at present. The attack path is straightforward: a remote party sends crafted HTTP requests to the vulnerable module, gains administrative access, and can then control the entire site. No additional user interaction is required beyond the initial request.