CVE-2026-35296 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. Operators, platform administrators, and security teams responsible for vulnerability management should review the official advisory and plan for updates or mitigations.

Technical summary

The vulnerability in Oracle WebCenter Sites, a product of Oracle Fusion Middleware, has a CVSS 3.1 Base Score of 9.8, indicating a high impact on confidentiality, integrity, and availability. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This critical vulnerability is caused by a weakness in the WebCenter Sites component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites, potentially leading to a takeover of the site. Successful attacks can result in a high impact on confidentiality, integrity, and availability. Administrators and users of affected versions should be aware of this vulnerability and take necessary actions to mitigate the risk. Defenders should verify the accuracy of their asset inventory and review relevant logs for potential exposure.

Defensive priority

High

Recommended defensive actions

• Apply the vendor-provided patches or updates to Oracle WebCenter Sites.
• Restrict access to the affected systems and monitor for suspicious activity.
• Implement additional security measures, such as firewalls and intrusion detection systems.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-06-17T10:40:21.783Z and last modified on 2026-06-17T18:45:10.323Z. The NVD entry is currently Analyzed. Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected. Defenders should verify the accuracy of their asset inventory and review relevant logs for potential exposure.

Official resources