CVE-2026-35293

Published Jun 16, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Analysis

Technical impact

This vulnerability in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker who can reach the appliance over HTTP to take full control of the site. The flaw creates a complete compromise, exposing all data, enabling modification or deletion, and potentially allowing the attacker to pivot to other systems.

Affected Systems

The only affected product is Oracle WebCenter Sites version 14.1.2.0.0 as specified in the vendor advisory. No other versions or components are listed as impacted.

Risk and Exploitability

The CVSS v3.1 score of 9.8 combined with an EPSS score of less than 1% indicates a critical severity but a low probability of exploitation in the current landscape. The vulnerability is not in the CISA KEV catalogue. Attackers can exploit it over the public internet using a simple HTTP request, without authentication, to gain full control of the application and its underlying data. Because it is network‑based and unauthenticated, exposed sites face a high risk of takeover.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle WebCenter Sites

affected

Version	Status	Constraints
`14.1.2.0.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:::::::*
	cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:::::::*

No data.

Vendor Product Versions

Oracle

Webcenter Sites

Version	Status	Scheme	Platform
`14.1.2.0.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Oracle patch or upgrade to a patched version as detailed in the security advisory.
Block or restrict HTTP access to the WebCenter Sites instance using firewalls or VPN requirements until a patch can be applied.
Enforce network segmentation and strict access controls around the WebCenter deployment so that only authorized internal traffic can reach the HTTP interface.

Generated by OpenCVE AI on June 18, 2026 at 23:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.483% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspujun2026.html

History

Jun 18, 2026 10:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated Remote Code Execution in Oracle WebCenter Sites 14.1.2.0.0 via HTTP
Weaknesses	CWE-284

Jun 18, 2026 4:45 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated Remote Code Execution in Oracle WebCenter Sites 14.1.2.0.0 via HTTP
Weaknesses		CWE-284 CWE-306
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 8:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared		Oracle Oracle webcenter Sites
CPEs		cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:::::::*
Vendors & Products		Oracle Oracle webcenter Sites
References		https://www.oracle.com/security-alerts/cspujun2026.html
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`