What is the CVSS score of CVE-2026-35293?

CVE-2026-35293 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-35293?

Oracle WebCenter Sites 14.1.2.0.0 contains a critical remote code execution vulnerability (CVSS 9.8) enabling unauthenticated attackers to achieve complete platform takeover over HTTP.

How to fix or mitigate CVE-2026-35293?

Within 24 hours: Identify all Oracle WebCenter Sites 14.1.2.0.0 instances and network-isolate them from untrusted environments. Within 7 days: Implement firewall rules restricting HTTP access to authorized users and administrative networks only; contact Oracle for patch availability timeline. Within 30 days: Deploy patched version or approved remediation alternative once vendor releases a fix.

Oracle WebCenter Sites CVE-2026-35293

EUVD-2026-37420 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easy unauthenticated HTTP takeover with full CIA impact, matching AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:29 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution and full product takeover affects Oracle WebCenter Sites 14.1.2.0.0 within Oracle Fusion Middleware, enabling unauthenticated attackers to compromise the platform over HTTP. Oracle's June 2026 Critical Patch Update rates this 9.8 (CVSS 3.1) with confidentiality, integrity, and availability all marked High, and Oracle describes it as easily exploitable. No public exploit identified at time of analysis, and CWE classification is not provided in the supplied data.

Technical ContextAI

Oracle WebCenter Sites is a Java-based web experience management (WEM) and content delivery platform that ships as part of Oracle Fusion Middleware, typically fronted by WebLogic Server and serving dynamic web pages via HTTP/HTTPS to public-facing audiences. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_webcenter_sites) confirms the WebCenter Sites application itself is the vulnerable component rather than an underlying middleware library. No CWE was assigned in the input, but Oracle's combination of network reach, low complexity, and no authentication for full takeover is consistent with classes such as authentication bypass, deserialization, or injection flaws historically seen in WebCenter Sites' content management and delivery endpoints.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update Advisory of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle WebCenter Sites 14.1.2.0.0 as soon as your change window permits, since Oracle does not typically publish standalone hotfixes outside the CPU cycle. Until the CPU can be deployed, place WebCenter Sites administrative and content-management interfaces behind a VPN or IP allowlist, terminate inbound HTTP at a WAF with rules blocking anomalous content-management API requests, and disable any internet-exposed delivery endpoints that are not required - accepting the trade-off that WAF signatures will be generic until patch diffing yields IOCs, and that allowlisting may break legitimate remote editor or syndication workflows. Increase logging on the WebLogic and WebCenter Sites layers to retain forensic evidence in case exploitation precedes patching.