CVE-2026-83034

CVE-2026-83034 is an easily exploitable vulnerability in the WebCenter Sites component of Oracle Fusion Middleware that allows an unauthenticated attacker with network access via HTTP to compromise the affected WebCenter Sites installation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the impact is limited to confidentiality: a successful attack yields unauthorized access to critical data or complete read access to all Oracle WebCenter Sites accessible data, with no integrity or availability impact. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 of WebCenter Sites. Organizations running these versions with the Sites application reachable over a network — especially internet-facing instances — are at risk of sensitive content and data exposure. As of now, the vulnerability is not in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 as soon as it is available via My Oracle Support. Restrict network-level access to Sites endpoints (especially any internet-exposed instances) using firewalls, VPNs, or reverse proxies with authentication until patched. Review HTTP access logs for unauthenticated requests to Sites resources that could indicate probing or data harvesting attempts.