An easily exploitable, critical vulnerability exists in Oracle WebCenter Sites that allows remote attackers to gain unauthorized control over the system via HTTP.

This vulnerability resides in the WebCenter Sites component and allows a low privileged, authenticated attacker with network access to compromise the application through HTTP requests. The vulnerability allows for scope change, meaning that the compromise of WebCenter Sites may extend to other products within the environment.

The CVSS score of 9.9 reflects the high potential for damage, including loss of data confidentiality and integrity. If exploited, an attacker could gain full administrative control over the WebCenter Sites platform, leading to severe reputational damage and significant business disruption.

Immediate Action: Apply the September 2026 Critical Security Patch Update provided by Oracle to address this vulnerability.

Proactive Monitoring: Analyze server logs for suspicious HTTP traffic patterns and monitor for any signs of unauthorized configuration changes or user account manipulation.

Compensating Controls: Utilize WAF configurations to block potentially malicious HTTP payloads and restrict access to the WebCenter Sites administrative interface to authorized internal networks only.

Public Exploit Available: No

Organizations should treat this vulnerability as high priority due to its critical severity and ease of exploitation. Administrators must apply the September 2026 Critical Security Patch Update as soon as possible to secure the WebCenter Sites environment.