Threats affecting pkg:maven/com.oracle/webcenter-sites

CVE-2026-91240 is a vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data. The vulnerability is rated with a CVSS 3.1 base score of 5.9, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation is considered difficult due to the high attack complexity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46809 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and integrity impacts without availability impact. Oracle has acknowledged the vulnerability in their June 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for these versions in the provided content. Oracle strongly recommends applying security patches promptly and suggests network-level mitigations until patches are applied.