What is the CVSS score of CVE-2026-35293?

CVE-2026-35293 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-35293?

Oracle WebCenter Sites 14.1.2.0.0 contains a critical remote code execution vulnerability (CVSS 9.8) enabling unauthenticated attackers to achieve complete platform takeover over HTTP.

How to fix or mitigate CVE-2026-35293?

Within 24 hours: Identify all Oracle WebCenter Sites 14.1.2.0.0 instances and network-isolate them from untrusted environments. Within 7 days: Implement firewall rules restricting HTTP access to authorized users and administrative networks only; contact Oracle for patch availability timeline. Within 30 days: Deploy patched version or approved remediation alternative once vendor releases a fix.

Oracle WebCenter Sites CVE-2026-35293

EUVD-2026-37420 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easy unauthenticated HTTP takeover with full CIA impact, matching AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:29 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution and full product takeover affects Oracle WebCenter Sites 14.1.2.0.0 within Oracle Fusion Middleware, enabling unauthenticated attackers to compromise the platform over HTTP. Oracle's June 2026 Critical Patch Update rates this 9.8 (CVSS 3.1) with confidentiality, integrity, and availability all marked High, and Oracle describes it as easily exploitable. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed WebCenter Sites 14.1.2.0.0 endpoint

Delivery

Send crafted unauthenticated HTTP request

Exploit

Trigger WebCenter Sites takeover flaw

Execution

Execute attacker-controlled logic in application context

Persist

Establish administrative foothold

Impact

Exfiltrate content and pivot into Fusion Middleware

Access

Identify exposed WebCenter Sites 14.1.2.0.0 endpoint

Delivery

Send crafted unauthenticated HTTP request

Exploit

Trigger WebCenter Sites takeover flaw

Execution

Execute attacker-controlled logic in application context

Persist

Establish administrative foothold

Impact

Exfiltrate content and pivot into Fusion Middleware

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Sites 14.1.2.0.0 reachable over HTTP, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All available signals point to a high-priority issue: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H combines network reach, low attack complexity, no privileges, and no user interaction with High impact across CIA, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' Counterbalancing signals are limited - no EPSS score, no CISA KEV listing, and no public POC were provided, so real-world exploitation pressure is currently unobserved in the supplied intelligence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker on the internet sends a crafted HTTP request to an exposed Oracle WebCenter Sites 14.1.2.0.0 instance, triggering the underlying flaw to gain code execution or administrative control over the application. From there they pivot to defacing public sites, exfiltrating editorial content and credentials cached by the platform, and using the WebLogic context to move laterally into the wider Fusion Middleware estate. …
Remediation	Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update Advisory of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle WebCenter Sites 14.1.2.0.0 as soon as your change window permits, since Oracle does not typically publish standalone hotfixes outside the CPU cycle. … Detailed patch versions, workarounds, and compensating controls in full report.