CVE-2026-61140

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 01/08/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites) version 14.1.2.0.0. An unauthenticated attacker can take over the content management system via HTTP.

Risk Assessment

Risk of full portal takeover, potentially leading to defacement, data theft, and service disruption.

Recommendation

Apply the Oracle critical patch for WebCenter Sites; restrict access to the admin panel.

Original NVD description (English source)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).