Oracle WebCenter Sites CVE-2026-35296

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, per CVSS AV:N/AC:L/PR:N/UI:N. The practical limiters are version (only those two releases are listed as affected) and network reachability of the WebCenter Sites HTTP listener, which is often fronted by WebLogic and may sit behind a reverse proxy or WAF in mature deployments; no specific feature toggle or non-default mode is required by Oracle's description.

All available signals point to high real-world priority: CVSS 3.1 of 9.8 with AV:N/AC:L/PR:N/UI:N means an unauthenticated remote attacker can exploit the issue over HTTP with low complexity and no user interaction, and Oracle explicitly characterizes successful attacks as 'takeover' of the product (C:H/I:H/A:H). EPSS data was not provided in the input, and the vulnerability is not flagged as KEV at the time of analysis, so there is no confirmation of active exploitation. POC availability is also unknown from the supplied references. Oracle WebCenter Sites historically appears in CISA KEV after CPU disclosures, so the absence of EPSS and KEV signals here is more likely a data-freshness gap than evidence of low real-world risk, and this CVE should be treated as a priority patch.

An attacker locates an internet-exposed Oracle WebCenter Sites instance (commonly fronted by WebLogic) and sends a single crafted HTTP request to a vulnerable endpoint, achieving full product takeover without credentials or user interaction. Because the issue is network-reachable and low-complexity, mass scanning followed by automated exploitation against unpatched 12.2.1.4.0 and 14.1.2.0.0 deployments is the realistic threat model once details or a POC emerge.