---
id: "CVE-2026-101499"
kind: "vulnerability"
aliases: ["CVE-2026-101499"]
title: "Oracle WebCenter Sites: unauthenticated network flaw allows full takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle WebCenter Sites", "fixed": ["Oct 2026 CPU patch"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fusion-middleware", "oracle", "package", "self-hosted", "webcenter-sites"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:17:59+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:09:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101499", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:09:08+00:00"}]
---

# Oracle WebCenter Sites: unauthenticated network flaw allows full takeover

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 have an unauthenticated HTTP flaw (CVSS 9.8) that lets an attacker take over the server. Fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC at this time.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle WebCenter Sites affected 12.2.1.4.0, 14.1.2.0.0 fixed Oct 2026 CPU patch

## How to check

Find your WebCenter Sites version (Oracle Fusion Middleware home: run OPatch lsinventory and check the WebCenter Sites version, or use the admin console). 12.2.1.4.0 and 14.1.2.0.0 are affected. Then check whether the October 2026 CPU patch for WebCenter Sites is in the lsinventory output.

## Fix

Apply the WebCenter Sites patch from Oracle's October 2026 CPU through My Oracle Support. The patch ID is not public in the sources I could read. Until it is applied, restrict network access to WebCenter Sites (do not expose it to the internet).

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101499
- 2026-10-23T23:09:08+00:00 analyst — Oracle CPU Oct 2026 (published 2026-10-19) lists it; CVE record confirms affected 12.2.1.4.0 and 14.1.2.0.0, CVSS 9.8. No patch number read: Oracle's risk matrix/MOS is login-gated. No exploitation or PoC found (not in KEV per Armis/OpenCVE). Did not search social posts.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101499 https://www.cve.org/CVERecord?id=CVE-2026-101499
- [mentions] CVE-2026-101499 Armis https://cve.armis.com/CVE-2026-101499

## From the sources

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_