Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality breach: unauthorized data access
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in Oracle WebCenter Sites allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data, potentially compromising all accessible data. The flaw results in a confidentiality breach with a CVSS score of 7.5, highlighting significant risk to sensitive information.

Affected Systems

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 are affected. These versions are part of Oracle Fusion Middleware and are deployed in many enterprise environments.

Risk and Exploitability

The weakness is exploitable over the public internet; no authentication is required, and it can be triggered by any machine with HTTP connectivity. The EPSS score is not available, but the CVSS base score indicates a high likelihood of significant data exposure. The vulnerability is not yet listed in the CISA KEV catalog, yet it remains a potential threat for exposed instances.

Generated by OpenCVE AI on October 21, 2026 at 10:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify which Oracle WebCenter Sites version is deployed and check whether it matches the affected list.
  • Apply the latest patch or upgrade from Oracle to a non‑vulnerable release.
  • Restrict HTTP access to the application to trusted networks only, using firewalls or VPNs.
  • Enforce strong authentication and disable any unnecessary default accounts on the WebCenter Sites installation.

Generated by OpenCVE AI on October 21, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote HTTP Attack Enabling Unauthorized Data Access in Oracle WebCenter Sites
Weaknesses CWE-200
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:11:11.268Z

Reserved: 2026-09-14T22:10:16.643Z

Link: CVE-2026-91542

cve-icon Vulnrichment

Updated: 2026-10-26T20:11:05.364Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:57.753

Modified: 2026-11-04T21:20:00.143

Link: CVE-2026-91542

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T15:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-287

    Improper Authentication