CVE-2026-61045: Oracle WebCenter Sites Auth Bypass Flaw

CVE-2026-61045 Overview

CVE-2026-61045 is a high-severity access control vulnerability affecting Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application without user interaction. Successful exploitation grants attackers unauthorized read access to critical data across the platform. Attackers can also perform limited unauthorized update, insert, or delete operations and trigger a partial denial of service. The vulnerability is categorized under [CWE-284] Improper Access Control and impacts Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated remote attackers can obtain full read access to Oracle WebCenter Sites data and cause partial service disruption over HTTP.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware (WebCenter Sites component)

Discovery Timeline

2026-08-18 - CVE-2026-61045 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-61045

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. An attacker requires no credentials and no user interaction to exploit the flaw. The attack channel is standard HTTP, making the exposure directly reachable from any network position that can reach the application.

Successful exploitation results in complete confidentiality loss for data accessible through WebCenter Sites. Attackers can also modify a subset of application data and disrupt availability partially. The scope remains unchanged, meaning the impact is contained within the vulnerable component itself.

The EPSS score is 0.261% with a percentile of 18.059, indicating a currently low modeled likelihood of exploitation in the short term. Oracle has not disclosed detailed technical mechanics in its advisory.

Root Cause

The issue is classified as [CWE-284] Improper Access Control. WebCenter Sites fails to properly enforce authorization checks on one or more HTTP-accessible endpoints. This gap enables unauthenticated requests to reach protected functionality and data. Oracle's advisory does not name the specific endpoint or handler responsible.

Attack Vector

Exploitation proceeds over the network via HTTP. The attacker sends crafted HTTP requests to an exposed WebCenter Sites instance. Because authentication is not required and attack complexity is low, weaponization does not depend on prior reconnaissance of credentials or user-driven actions. Refer to the Oracle Security Alert for vendor-provided technical details.

Detection Methods for CVE-2026-61045

Indicators of Compromise

Anomalous HTTP requests to WebCenter Sites endpoints originating from unauthenticated sessions or unfamiliar source IPs.
Unexpected bulk read operations, data enumeration patterns, or content modifications in WebCenter Sites logs.
Elevated response payload sizes on endpoints that normally require authentication.

Detection Strategies

Inventory Oracle Fusion Middleware deployments and identify WebCenter Sites instances at versions 12.2.1.4.0 and 14.1.2.0.0.
Review web server and application logs for HTTP requests to WebCenter Sites URIs lacking valid session or authentication headers.
Correlate authentication logs with content management activity to identify content changes without a corresponding authenticated session.

Monitoring Recommendations

Enable verbose HTTP access logging on WebCenter Sites and forward logs to a centralized analytics platform.
Alert on spikes in HTTP request volume, error rates, or partial service degradation on WebCenter Sites hosts.
Monitor egress traffic from WebCenter Sites servers for signs of data exfiltration following suspicious inbound requests.

How to Mitigate CVE-2026-61045

Immediate Actions Required

Apply the patches referenced in the Oracle Critical Patch Update Advisory - August 2026 as the primary remediation.
Restrict network exposure of WebCenter Sites administrative and content endpoints to trusted networks and jump hosts.
Audit WebCenter Sites data and content stores for unauthorized reads or modifications since first exposure.

Patch Information

Oracle released fixes as part of its Critical Patch Update cycle. Administrators should consult the Oracle Security Alert for the exact patch identifiers corresponding to WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0. Apply the patches in a staged environment before rolling to production.

Workarounds

Place WebCenter Sites behind a web application firewall configured to block anonymous requests to sensitive URIs.
Enforce network-level access controls that limit HTTP access to authenticated internal users and known integration systems.
Disable or firewall any non-essential WebCenter Sites endpoints until patches are applied.

bash

# Configuration example
# Example WAF/reverse-proxy rule to require authentication before reaching WebCenter Sites
# Adjust paths and auth handler to match your deployment
location /cs/ {
    auth_request /auth;
    proxy_pass http://webcenter_sites_backend;
}

location = /auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}