Description
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Immediate Patch
AI Analysis

Impact

The flaw permits an unauthenticated attacker with network access via HTTP to read sensitive data stored in Oracle WebCenter Sites, such as configuration files, content, or user information. It originates from improper access controls (CWE-200, CWE-284, CWE-285) that allow data disclosure without authentication or authorization. The attack results in a pure confidentiality breach and does not affect integrity or availability.

Affected Systems

Oracle WebCenter Sites component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The vulnerability is present in the web tier exposed through the HTTP interface of the WebCenter Sites application.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 indicates high severity, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) shows the issue is exploitable over the network without credentials. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the low exploitation barrier and potential for data loss warrant immediate attention.

Generated by OpenCVE AI on October 27, 2026 at 01:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a version that contains the fix.
  • Restrict the WebCenter Sites HTTP interface with firewall rules or VPN so only trusted hosts can reach it.
  • Enable comprehensive application logging and monitor for anomalous read activity to detect premature exploitation.

Generated by OpenCVE AI on October 27, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Breach in Oracle WebCenter Sites

Mon, 26 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Data Breach in Oracle WebCenter Sites
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle webcenter Sites
CPEs cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Sites
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Webcenter Sites
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-26T20:17:05.199Z

Reserved: 2026-09-14T22:10:16.643Z

Link: CVE-2026-91552

cve-icon Vulnrichment

Updated: 2026-10-26T20:16:59.328Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:58.433

Modified: 2026-11-04T21:20:29.057

Link: CVE-2026-91552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T02:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control

  • CWE-285

    Improper Authorization