CVE-2026-61029
CriticalCVSS 9.0Summary
Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.0.
Risk Assessment
High risk – an unauthenticated attacker can compromise the system, leading to loss of confidentiality, integrity, and availability, and may affect other systems.
Recommendation
Apply Oracle patches for versions 12.2.1.4.0 and 14.1.2.0.0. Restrict HTTP access and monitor network traffic.
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).