Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle WebCenter Sites allows a low‑privileged attacker with network access via HTTP to compromise the application. Exploitation can lead to full takeover, impacting confidentiality, integrity, and availability of the system. The weakness stems from inadequate protection against remote code execution through the web interface.

Affected Systems

The affected products are Oracle WebCenter Sites version 12.2.1.4.0 and 14.1.2.0.0, which are part of Oracle Fusion Middleware. No other versions are listed as affected.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 indicates high severity with network access, low attack complexity, and low privileges required. The EPSS score is reported as less than 1 %, meaning exploitation probability is currently very low but not zero. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over HTTP; an attacker with a low‑privileged account can exploit the flaw to execute code and gain control of the WebCenter Sites instance.

Generated by OpenCVE AI on September 17, 2026 at 04:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle WebCenter Sites patch for versions 12.2.1.4.0 or 14.1.2.0.0.
  • Restrict HTTP exposure of WebCenter Sites to trusted networks or configure firewall rules to limit external access.
  • Enforce strong authentication and least‑privilege policies on user accounts to reduce the effect of low‑privileged exploitation.

Generated by OpenCVE AI on September 17, 2026 at 04:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle WebCenter Sites via HTTP
Weaknesses CWE-20

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:25:30.319Z

Reserved: 2026-08-31T15:40:57.333Z

Link: CVE-2026-83032

cve-icon Vulnrichment

Updated: 2026-09-16T15:43:29.751Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-15T20:18:11.500

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83032

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T04:15:11Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control