What is the CVSS score of CVE-2026-35296?

CVE-2026-35296 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-35296?

Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVE-2026-35296, CVSS 9.8) enabling unauthenticated remote system takeover, creating immediate risk of complete data…

How to fix or mitigate CVE-2026-35296?

**Within 24 hours:** Identify and catalog all systems running WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0; restrict network-layer access to affected instances from trusted IPs only via firewall rules; enable enhanced logging and alerting on these systems. **Within 7 days:** Deploy Web Application Firewall rules targeting exploitation patterns when available; establish daily coordination with Oracle for patch timeline; assess upgrade path to unaffected WebCenter Sites versions. **Within 30 days:** Execute upgrade to patched version once released by Oracle, or migrate to alternative content management platforms if patch timeline exceeds organizational risk tolerance.

Oracle WebCenter Sites CVE-2026-35296

EUVD-2026-37423 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated HTTP-reachable takeover with no user interaction, justifying AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:31 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is possible by unauthenticated attackers over HTTP, with full compromise of confidentiality, integrity, and availability per Oracle's June 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 reflects network-reachable, low-complexity exploitation with no user interaction, placing this among the most severe Fusion Middleware issues in the cycle. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is the Java-based web experience management (WEM) platform within Oracle Fusion Middleware, used to author, target, and deliver web content across customer-facing sites. The affected versions (12.2.1.4.0 and 14.1.2.0.0) run on top of WebLogic and expose multiple HTTP-facing endpoints (content management, satellite servers, REST APIs). No CWE is published by Oracle for this advisory, which is consistent with Oracle's standard CPU disclosure practice of withholding root-cause classification; the CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with 'takeover' language strongly implies a server-side flaw reachable through normal HTTP request handling rather than a client-side or configuration-dependent bug.

RemediationAI

Apply the patches shipped in the Oracle Critical Patch Update of June 2026 for Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish point-fix versions outside the CPU, so the CPU patch itself is the authoritative remediation. Until the CPU can be staged through change control, restrict HTTP and HTTPS access to WebCenter Sites management, satellite, and REST endpoints to trusted networks via WAF rules or network ACLs, and place the deployment behind an authenticating reverse proxy; this will break public preview and unauthenticated content delivery flows if those are in use, so verify which paths must remain externally reachable. Increase logging on the WebLogic and WebCenter Sites HTTP tiers to capture anomalous request patterns while the patch is pending.