This vulnerability affects Oracle WebCenter Sites 14.1.2.0.0 and allows an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity. The vulnerability is publicly disclosed and assigned CVE-2026-61140 with a critical severity rating. Oracle's July 2026 Critical Patch Update advisory references multiple security patches across products but does not explicitly confirm a patch for this version of Oracle WebCenter Sites. Customers are strongly advised to review the advisory and apply any relevant patches promptly.

The vulnerability allows complete compromise of Oracle WebCenter Sites 14.1.2.0.0 by an unauthenticated attacker remotely over HTTP. This includes full confidentiality, integrity, and availability impacts, meaning attackers can access sensitive data, modify or delete content, and disrupt service availability. The critical CVSS score of 9.8 reflects the severity and ease of exploitation without authentication or user interaction.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. As the advisory does not explicitly confirm a patch for Oracle WebCenter Sites 14.1.2.0.0, customers must verify patch applicability and apply updates promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability.