CVE-2026-91542 in WebCenter Sites
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle WebCenter Sites component of the Oracle Fusion Middleware suite, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw is classified as a critical information disclosure issue that allows an unauthenticated attacker to compromise the integrity and confidentiality of the application data. The vulnerability stems from improper access control mechanisms within the HTTP handling logic, which fails to adequately restrict sensitive endpoints or API calls from users who have not been authenticated by the system. Because the attack vector requires only network access via standard HTTP protocols, it is easily exploitable without the need for user interaction or complex social engineering tactics. This characteristic significantly lowers the barrier to entry for malicious actors seeking to target these specific versions of Oracle WebCenter Sites deployed in internet-facing environments.
From a technical perspective, the flaw represents a classic case of broken access control where the application does not properly verify whether an incoming request originates from an authorized user session before processing it or returning sensitive data. The absence of proper authentication checks on certain internal APIs or administrative interfaces allows remote attackers to bypass security controls entirely. By sending crafted HTTP requests directly to these unprotected endpoints, an attacker can retrieve critical configuration files, database connection strings, user credentials, or other proprietary business logic stored within the WebCenter Sites repository. This aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if sensitive data is exposed through misconfigured defaults, though the primary classification remains focused on unauthorized information retrieval due to insufficient authorization checks.
The operational impact of this vulnerability is severe, as indicated by a CVSS 3.1 Base Score of 7.5 with high confidentiality impacts and no direct impact on integrity or availability in its base form. Successful exploitation enables an attacker to gain complete access to all Oracle WebCenter Sites accessible data without prior authentication. This can lead to the exfiltration of sensitive customer information, intellectual property, internal network topology details, and administrative credentials stored within the content management system. The compromise of such a central hub for digital experience delivery can have cascading effects on an organization's security posture, potentially serving as a foothold for further lateral movement or additional attacks against connected systems. In terms of adversary behavior, this vulnerability maps to ATT&CK technique T1078 Valid Accounts if the attacker uses stolen credentials later, but initially it aligns with T1539 Steal Web Session Cookie or more broadly T1213 Data from Information Repositories as the primary goal is data extraction rather than system modification.
Mitigation strategies must focus on immediate remediation and defensive hardening to reduce the attack surface. The most effective solution is to apply the latest security patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0, which address the underlying access control logic flaws. Organizations should verify their deployment status using Oracle's official support tools or configuration scanners to ensure all instances are updated. In scenarios where patching is not immediately feasible due to operational constraints, network-level controls such as Web Application Firewalls can be configured to block requests targeting known vulnerable endpoints or those lacking proper authentication headers. Additionally, implementing strict IP whitelisting for administrative interfaces and ensuring that no sensitive components are exposed directly to the public internet via reverse proxies will significantly reduce exposure. Regular security assessments and penetration testing should also be conducted to identify any similar misconfigurations across other middleware components within the Fusion Middleware stack.