CVE-2026-91240 in WebCenter Sites
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle WebCenter Sites component of the Oracle Fusion Middleware suite, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw is classified as a critical integrity issue that allows for unauthorized access to sensitive data stored by the application. The vulnerability stems from an improper implementation of authentication or authorization controls within the HTTP handling mechanisms of the WebCenter Sites server. While Oracle has characterized this defect as difficult to exploit, it remains accessible to unauthenticated attackers who possess network connectivity to the target system via standard HTTP protocols. This classification suggests that while the attack vector is remote and does not require user interaction, successful exploitation may involve complex conditions or specific environmental configurations that are not universally present across all deployments of the affected software versions.
From a technical perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, and potentially CWE-306, Missing Authentication for Critical Function, depending on the exact nature of the code flaw allowing access to protected resources. The attacker leverages network-based HTTP requests to bypass security checks that should restrict access to administrative functions or sensitive data endpoints. Because the vulnerability permits unauthenticated access, it effectively neutralizes the primary defense mechanism designed to protect the integrity and confidentiality of the WebCenter Sites environment. This allows an external actor to interact with internal APIs or interfaces without providing valid credentials, thereby gaining a foothold within the application layer.
The operational impact of this vulnerability is significant due to its direct effect on data confidentiality. As indicated by the CVSS 3.1 base score of 5.9 and the specific vector components AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, the primary consequence is a high level of compromise regarding confidential information while integrity and availability remain largely unaffected in this specific context. Successful exploitation enables an attacker to retrieve critical data accessible by Oracle WebCenter Sites, which may include user profiles, content metadata, configuration details, or other proprietary business information stored within the system's database. Although immediate arbitrary code execution is not reported as a direct outcome of this specific flaw, the exposure of such sensitive data can lead to severe privacy violations, regulatory non-compliance, and potential groundwork for further attacks if additional vulnerabilities are discovered in conjunction with this access.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically when considering how unauthenticated actors might mimic legitimate traffic or exploit misconfigurations that effectively grant valid account privileges without proper verification. It also relates to T1539, Steal Web Session Cookie, if the mechanism involves session hijacking through exposed endpoints, though the primary description emphasizes direct unauthorized access rather than session theft. The difficulty in exploitation suggests that automated scanning tools may not easily detect this issue, requiring more sophisticated manual testing or specific exploit conditions to trigger the vulnerability successfully.
Mitigation strategies for this vulnerability should prioritize immediate patching if Oracle has released a security update addressing this specific flaw in versions 12.2.1.4.0 and 14.1.2.0.0. Organizations must verify their current software version against the supported list provided by Oracle to determine applicability. In cases where patching is not immediately feasible, network-level controls should be implemented to restrict access to WebCenter Sites endpoints from untrusted networks. This includes configuring firewalls or web application firewalls to block HTTP requests that exhibit patterns associated with exploitation attempts for this vulnerability. Additionally, implementing strict input validation and ensuring that all administrative interfaces are only accessible via authenticated sessions can help mitigate the risk of unauthorized data exposure. Regular security assessments and penetration testing should be conducted to identify any similar misconfigurations in authentication logic across the middleware environment.