A vulnerability tracked as CVE-2026-61029 has been disclosed affecting Oracle WebCenter Sites, described as allowing an unauthenticated remote attacker to compromise the product, with impact potentially extending to adjacent systems through a scope change. Severity scoring, product versions, and vendor attribution below reflect the initial CVE record and have not yet been independently confirmed against Oracle's published advisory.
What Is It
CVE-2026-61029 is described as a vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware. Per the CVE description, the flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites, with successful attacks resulting in takeover of the product. The description also characterizes the vulnerability as difficult to exploit, indicating high attack complexity.
The CVSS 3.1 vector, base score, and severity rating carried in the initial record have not been verified against Oracle's own advisory and should not be treated as settled. Administrators sizing this issue should pull the authoritative scoring from Oracle's Critical Patch Update documentation rather than from pre-enrichment CVE data.
Why It Matters
Two properties drive the reported severity. First, no authentication and no user interaction are required; the attack surface is any reachable HTTP listener. Second, the scope is reported as Changed: while the vulnerability is said to live in WebCenter Sites, attacks may significantly impact additional products. A compromise would not stay contained to the vulnerable component.
The stated mitigating factor is attack complexity. The record classifies this as difficult to exploit, which raises the bar for an attacker but does not change the outcome if they clear it. Because the exploitability and impact subscores in the initial record are unconfirmed, they are omitted here; treat the qualitative picture, unauthenticated, network-reachable, scope-changing, hard to exploit, as the operative summary until Oracle's advisory is consulted.
What's Vulnerable
The initial CVE record lists Oracle WebCenter Sites in the Oracle Fusion Middleware product family, naming supported versions in the 12.2.1.4.0 and 14.1.2.0.0 lines. These version identifiers and the vendor attribution have not been confirmed against Oracle's advisory. Before scoping an inventory sweep or declaring systems out of scope, verify the affected-version list directly in Oracle's August 2026 Critical Patch Update; the pre-enrichment record is not a reliable basis for exclusion decisions.
Patch Status
The CVE was published 2026-08-18 and its NVD record is currently in Received status, meaning NVD enrichment and CPE analysis are still pending. That status is precisely why the scoring and version data above carry caveats. The vulnerability is documented in Oracle's August 2026 Critical Patch Update, which is the authoritative source for severity, affected releases, fixed versions, and patch availability; administrators should consult that advisory directly and apply the CPU.
No CISA KEV entry was supplied for this CVE. There is no evidence in the source material of active exploitation in the wild, and no KEV-mandated remediation deadline applies at this time.
Sources
- NVD, CVE-2026-61029: https://nvd.nist.gov/vuln/detail/CVE-2026-61029
- Oracle Critical Patch Update Advisory, August 2026: https://www.oracle.com/security-alerts/cpuaug2026.html
- Oracle Security Alerts index (canonical entry point for all CPU advisories): https://www.oracle.com/security-alerts/