Oracle WebCenter Sites CVE-2026-35295

Attacker must (1) have network reachability to the WebCenter Sites HTTP/HTTPS interface, (2) possess valid credentials for at least a low-privileged WebCenter Sites role (PR:L - anonymous access is insufficient), and (3) satisfy the AC:H preconditions implied by Oracle, meaning the exploit is not reliable against a default configuration and likely depends on specific tenant/site setup, race conditions, or chained state that the attacker does not directly control. No user interaction is required (UI:N) and scope is unchanged (S:U), so compromise is bounded to the WebCenter Sites instance itself; the vulnerability cannot be triggered without an authenticated session, which is the primary limiting factor.

The signals are mixed and point to a moderate-priority issue rather than an emergency. CVSS 3.1 is 7.5 (High) driven by full C/I/A impact, but the vector AV:N/AC:H/PR:L materially lowers real-world exploitability: an attacker needs at least a low-privileged WebCenter Sites account AND must satisfy conditions outside their control (AC:H), which historically corresponds to specific configuration, timing, or chained preconditions. No EPSS score, no CISA KEV listing, and no public POC have been reported, and the only reference is Oracle's own June 2026 CPU advisory. The 'Information Disclosure' tag conflicts with the vendor's 'takeover' impact wording - trust the CVSS vector and Oracle text (C:H/I:H/A:H = full takeover) over the tag. Net: prioritize patching ahead of routine maintenance for internet-exposed or multi-tenant WebCenter Sites instances, but it is not in the same tier as an unauthenticated RCE.

An attacker who has obtained or been provisioned a low-privileged WebCenter Sites account - for example a contributor or limited editor role on a customer-facing CMS - authenticates over HTTP and issues a crafted request to a vulnerable Sites endpoint, triggering the flaw under the specific conditions required by AC:H. After successful exploitation the attacker escalates to full control of the WebCenter Sites instance, allowing content tampering, theft of unpublished content and credentials, and disruption of the site. No public exploit identified at time of analysis, so this scenario is plausible based on the vendor's takeover language rather than demonstrated code.