CVE-2026-91552 in WebCenter Sites
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle WebCenter Sites component of the Oracle Fusion Middleware suite, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw represents a significant risk to organizations relying on this content management platform for digital experience delivery. The core issue stems from an improper access control mechanism that fails to adequately restrict unauthenticated users from interacting with sensitive internal endpoints or data structures within the application logic. Because the vulnerability is accessible via standard HTTP protocols, it does not require any specialized network positioning such as being inside a private subnet, nor does it demand user interaction like clicking a malicious link or authenticating first. This combination of factors makes the flaw particularly dangerous in internet-facing deployments where WebCenter Sites instances are typically exposed to external traffic for content publishing and management purposes.
From an operational perspective, the exploitation of this vulnerability allows an unauthenticated attacker with network access to compromise the integrity and confidentiality of the system without prior credentials. The primary impact is a high level of unauthorized data exposure, as indicated by the CVSS 3.1 base score of 7.5 which highlights severe impacts on confidentiality while leaving integrity and availability unaffected in this specific vector. Successful exploitation enables attackers to retrieve critical business data stored within WebCenter Sites, including potentially sensitive customer information, proprietary content drafts, or configuration details that could facilitate further attacks. The ability to access all Oracle WebCenter Sites accessible data means that the scope of compromise is limited only by what the application itself can reach, which may include backend databases or integrated systems depending on the specific deployment architecture and permissions granted to the web service accounts.
In terms of industry standard classification, this vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure in enforcing security policies regarding who is permitted to access certain resources. Furthermore, from an adversary behavior perspective consistent with MITRE ATT&CK frameworks, this flaw facilitates the Initial Access and Credential Access tactics by allowing attackers to harvest sensitive data directly without needing valid user credentials first. The lack of authentication requirement places this vulnerability in a high-risk category for automated scanning tools used by threat actors who routinely probe public-facing web applications for such weaknesses. The network-based nature of the attack vector means that once an attacker identifies the vulnerable version, they can execute remote code or data exfiltration techniques from any location on the internet where HTTP traffic is permitted through firewalls and security groups.
To mitigate this risk, organizations running Oracle WebCenter Sites versions 12.2.1.4.0 or 14.1.2.0.0 must apply the latest available patches provided by Oracle as part of their Critical Patch Update cycle. Immediate remediation is strongly advised to close the unauthorized access path before it can be exploited in the wild. In addition to patching, defensive measures should include restricting direct HTTP access to WebCenter Sites administrative interfaces and sensitive endpoints through network segmentation or web application firewalls that enforce strict authentication requirements for all requests targeting these areas. Monitoring logs for unusual patterns of unauthenticated access attempts can also help detect exploitation activities early. Ensuring that the middleware is kept up-to-date with Oracle's security advisories remains the most effective long-term strategy to prevent recurrence of such vulnerabilities in future versions.