CVE-2026-83033

Oracle WebCenter Sites, a component of Oracle Fusion Middleware, contains an easily exploitable vulnerability rated CVSS 3.1 8.8 (high) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker who already holds low-privileged credentials for WebCenter Sites can trigger the flaw through a simple HTTP request to the application, with no user interaction required. Successful exploitation allows the attacker to take over the Oracle WebCenter Sites installation, with high impact on the confidentiality, integrity, and availability of the system. Organizations running either affected version — especially deployments with network-reachable instances or many low-privilege contributor accounts — are exposed. The vulnerability is not on the CISA KEV list and no public proof-of-concept is known, but the low attack complexity makes patching a priority.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83033 to all WebCenter Sites instances running 12.2.1.4.0 or 14.1.2.0.0. Restrict network/HTTP reachability of WebCenter Sites — particularly admin and content-management interfaces — to trusted users and networks, and audit low-privileged accounts for signs of misuse. Monitor authentication and application logs for anomalous activity by low-privilege users preceding configuration or privilege changes.