Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Oracle WebCenter Sites is vulnerable to an unauthenticated, network-accessible flaw that enables attackers to execute arbitrary code on the host. The flaw arises from improper authentication handling (CWE-287) and the use of insecure default credentials (CWE-306). Successful exploitation results in complete takeover of the application, compromising confidentiality, integrity, and availability of all hosted content.

Affected Systems

The affected products are Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware. These versions are listed as impacted in the Oracle advisory and confirmed by the CVE description.

Risk and Exploitability

The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting a low likelihood of widespread active exploitation at present, and it is not yet listed in the CISA KEV catalog. Nonetheless, the attack vector is local network access over HTTP and requires no prior authentication, so any exposed instance is at high risk of compromise.

Generated by OpenCVE AI on September 17, 2026 at 04:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the Oracle patch for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 that fixes the authentication bypass flaw.
  • Restrict HTTP and HTTPS access to the WebCenter Sites servers to trusted IP ranges or enforce access through a VPN to prevent unauthenticated connections.
  • Review and strengthen the site’s authentication configuration, ensuring that default or weak credentials are disabled and that strong password policies and multifactor authentication are enforced.

Generated by OpenCVE AI on September 17, 2026 at 04:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle WebCenter Sites via HTTP

Wed, 16 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:38.171Z

Reserved: 2026-08-31T15:40:57.333Z

Link: CVE-2026-83035

cve-icon Vulnrichment

Updated: 2026-09-15T22:46:01.660Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-15T20:18:11.853

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83035

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T04:15:11Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function