Oracle WebCenter Sites Has Critical Unauthenticated Remote Code Execution Flaw

Oracle WebCenter Sites contains a critical vulnerability that allows unauthenticated attackers to take control of the system. The National Vulnerability Database lists this flaw as CVE-2026-101499 with a CVSS score of 9.8.

The vulnerability is rated as easily exploitable and requires no authentication from the attacker. According to the NVD record, an attacker with network access via HTTP can compromise the Oracle WebCenter Sites product. Successful exploitation results in the complete takeover of the affected system.

Context and Background

The flaw resides within the Oracle WebCenter Sites component of Oracle Fusion Middleware. The National Vulnerability Database describes the issue as a weakness that impacts confidentiality, integrity, and availability. The CVSS 3.1 vector indicates that the attack vector is network-based and the complexity is low.

The base score of 9.8 reflects the high impact on all three security pillars. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that no user interaction is required. This makes the vulnerability particularly dangerous for systems exposed to the internet.

Who Is Affected

Specific versions of Oracle WebCenter Sites are confirmed to be affected by this vulnerability. According to the NVD record, version 12.2.1.4.0 is vulnerable. Organizations running this specific build of the software are at risk of exploitation.

Another supported version is also affected by this critical flaw. The NVD record identifies version 14.1.2.0.0 as vulnerable. Any deployment using this version lacks protection against this specific unauthenticated attack vector.

What should you do?

Organizations should immediately verify if they are running the affected versions of Oracle WebCenter Sites. Since the vulnerability allows unauthenticated access, exposed systems are at significant risk. Administrators should check their inventory for versions 12.2.1.4.0 and 14.1.2.0.0.

There is no confirmed fix mentioned in the current NVD record. Users should monitor Oracle’s security alerts for updates. Until a patch is available, restricting network access to the affected components may reduce exposure.

What to do and how to stay safe

• Inventory all instances of Oracle WebCenter Sites to identify affected versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict HTTP access to WebCenter Sites servers to trusted networks or IP addresses if possible.
• Monitor system logs for unusual activity or unauthorized access attempts on the affected components.
• Wait for official vendor guidance before applying any un

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.