CVE-2026-83037

CVE-2026-83037 is a critical (CVSS 9.8) vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is described by Oracle as easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction. A successful attack allows complete takeover of the Oracle WebCenter Sites installation, with high impact on confidentiality, integrity, and availability. Organizations running either affected version with the Sites application reachable over a network are exposed, particularly if the service is internet-facing. No public proof of concept is known and the flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known at this time.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83037 to all WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 installations as the highest priority. Until patched, restrict network access to the Sites application so only trusted users and networks can reach it over HTTP, and avoid exposing admin interfaces to the internet. Review logs for unauthenticated HTTP requests to WebCenter Sites endpoints for signs of probing or abuse.