CVE-2026-83032

Oracle WebCenter Sites, a component of Oracle Fusion Middleware, contains an easily exploitable vulnerability in versions 12.2.1.4.0 and 14.1.2.0.0 that allows a low-privileged authenticated attacker with network access via HTTP to compromise the entire WebCenter Sites installation. Successful exploitation results in a full takeover of the product, with high impact on the confidentiality, integrity, and availability of managed content and the platform itself (CVSS 3.1 base score 8.8). Any organization running one of the two affected supported versions and exposing the product over a network is at risk, with the attack requiring only a valid low-privilege account rather than administrative credentials. No public proof-of-concept exists and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently observed in the wild. Patches are delivered through Oracle's Critical Patch Update program.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83032 to any WebCenter Sites instance running 12.2.1.4.0 or 14.1.2.0.0, as Oracle distributes fixes via CPU rather than standalone version bumps. Until patched, restrict HTTP/HTTPS access to WebCenter Sites (especially authoring and admin interfaces) via network segmentation or VPN-only exposure, and audit low-privileged accounts for suspicious activity or unexpected privilege changes.