{"id":"CVE-2026-101499","kind":"vulnerability","aliases":["CVE-2026-101499"],"related":[],"title":"Oracle WebCenter Sites: unauthenticated network flaw allows full takeover","description":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 have an unauthenticated HTTP flaw (CVSS 9.8) that lets an attacker take over the server. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC at this time.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebCenter Sites","fixed":["Oct 2026 CPU patch"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["fusion-middleware","oracle","package","self-hosted","webcenter-sites"],"not_affected_if":["other-versions"],"how_to_check":"Find your WebCenter Sites version (Oracle Fusion Middleware home: run OPatch lsinventory and check the WebCenter Sites version, or use the admin console). 12.2.1.4.0 and 14.1.2.0.0 are affected. Then check whether the October 2026 CPU patch for WebCenter Sites is in the lsinventory output.","fix":"Apply the WebCenter Sites patch from Oracle's October 2026 CPU through My Oracle Support. The patch ID is not public in the sources I could read. Until it is applied, restrict network access to WebCenter Sites (do not expose it to the internet).","status":"open","published_at":"2026-10-20T22:17:59+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:57+00:00","updated_at":"2026-10-23T23:09:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:38:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for WebCenter Sites; the sources do not name the patched version.","reach":"internet","title":"Oracle WebCenter Sites: unauthenticated network flaw allows full takeover","impact":"high","summary":"Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that an unauthenticated attacker can reach over HTTP. Successful exploitation gives the attacker takeover of the WebCenter Sites server, with high impact to confidentiality, integrity and availability.","category":"package","who_cares":["oracle","webcenter-sites","fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the WebCenter Sites server over HTTP","analyst_note":"Find the Oracle Security Alert advisory and patched version for CVE-2026-101499 and confirm the exact affected builds.","how_to_check":"Check whether WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 is deployed, for example with the installed version in the Oracle Fusion Middleware home or the admin console.\nunknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000555,"input_tokens":3095,"output_tokens":491,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get patch versions and any workaround; check https://nvd.nist.gov/vuln/detail/CVE-2026-101499 and Oracle's security alerts page.","search":"'-101499':12A,15A '-2026':11A,14A '/av':135C '12.2.1.4.0':33B,89C '14.1.2.0.0':35B,91C '2026':56B '3.1':122C,134C '9.8':42B,125C 'access':100C 'affect':87C 'allow':7A,95C 'attack':46B,97C,109C 'avail':129C 'base':123C 'compon':80C 'compromis':104C 'confidenti':126C 'critic':57B 'cve':10A,13A 'cvss':41B,121C,131C,133C 'easili':92C 'exploit':62B,93C 'fix':51B 'flaw':6A,40B 'full':8A 'fusion':20B,78C 'fusion-middlewar':19B 'h':143C 'h/a':142C 'h/i':141C 'host':26B 'http':39B,102C 'impact':130C 'integr':127C 'known':61B 'l/pr':137C 'let':44B 'middlewar':21B,79C 'n/ac':136C 'n/s':139C 'n/ui':138C 'network':5A,99C 'octob':55B 'oracl':1A,22B,30B,53B,72C,77C,105C,118C 'oracle':16A 'packag':23B 'patch':58B 'poc':65B 'product':75C 'public':64B 'result':114C 'score':124C 'self':25B 'self-host':24B 'server':50B 'site':3A,29B,32B,74C,82C,107C,120C 'sites':18A 'success':108C 'support':83C 'take':47B 'takeov':9A,116C 'time':68B 'u/c':140C 'unauthent':4A,38B,96C 'updat':59B 'vector':132C 'version':84C 'via':101C 'vulner':69C,94C,112C 'webcent':2A,28B,31B,73C,81C,106C,119C 'webcenter':17A 'webcenter-sit':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101499","severity":null,"published_at":"2026-10-20T22:17:59+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101499:380","url":null,"severity":null,"published_at":"2026-10-23T23:09:08+00:00","modified_at":"2026-10-23T23:09:08+00:00","first_seen_at":"2026-10-23T23:09:08+00:00","fetched_at":"2026-10-23T23:09:08+00:00","note":"Oracle CPU Oct 2026 (published 2026-10-19) lists it; CVE record confirms affected 12.2.1.4.0 and 14.1.2.0.0, CVSS 9.8. No patch number read: Oracle's risk matrix/MOS is login-gated. No exploitation or PoC found (not in KEV per Armis/OpenCVE). Did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1811,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101499","title":"CVE Record: CVE-2026-101499","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1807,"url":"https://cve.armis.com/CVE-2026-101499","title":"CVE-2026-101499 Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}