CVE-2026-91552 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or all accessible data within Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges.
CVE-2026-91542 is a vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with a confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across multiple products.
CVE-2026-101499 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities. Customers are strongly advised to apply the relevant patches promptly.
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83034 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or potentially all accessible data within Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring privileges or user interaction. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products.
CVE-2026-83033 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update.
CVE-2026-83032 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this fix in its September 2026 Critical Security Patch Update (CSPU).
CVE-2026-83031 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to fully compromise the product, potentially impacting additional Oracle products. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update advisory.
CVE-2026-61054 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or all accessible data within Oracle WebCenter Sites. The attacker can also perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts.
CVE-2026-61045 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data, modify some data, or cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 8.6, indicating significant confidentiality, integrity, and availability impacts.
CVE-2026-61042 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has acknowledged the issue in their August 2026 Critical Security Patch Update advisory and recommends applying available patches promptly.
CVE-2026-61040 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has addressed this issue in their August 2026 Critical Security Patch Update.
CVE-2026-61038 is a high-severity vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or full access to all data accessible through Oracle WebCenter Sites. The attacker can also perform unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating a significant confidentiality and integrity impact. Oracle has released security patches addressing this and many other vulnerabilities in their August 2026 Critical Security Patch Update. Users are strongly advised to apply these patches promptly.
CVE-2026-61034 is a critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability also has a scope change impact, affecting additional Oracle products. The CVSS 3.1 base score is 9.1, indicating critical severity with high confidentiality, integrity, and availability impacts. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities.