What is the CVSS score of CVE-2026-35318?

CVE-2026-35318 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-35318?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability (CVSS 8.8) allowing low-privileged remote attackers to achieve full system compromise via…

How to fix or mitigate CVE-2026-35318?

Within 24 hours: Inventory all systems running WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0; implement network-level access controls restricting HTTP access to trusted sources only; audit and revoke unnecessary low-privilege user accounts. Within 7 days: Deploy Web Application Firewall with account takeover detection rules; enable comprehensive access logging with real-time alerts on authentication anomalies and privilege escalation; confirm upgrade path feasibility for versions beyond 14.1.2.0.0 with Oracle. Within 30 days: Execute upgrade to patched version immediately upon Oracle release; if upgrade delays exceed 90 days, evaluate alternative solutions or decommission affected instances; conduct forensic review of authentication logs for compromise indicators.

Oracle WebCenter Sites CVE-2026-35318

EUVD-2026-37444 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Information Disclosure Oracle Oracle Webcenter Sites Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable (AV:N), Oracle calls it easily exploitable (AC:L), requires one low-privileged WebCenter Sites account (PR:L), no user interaction, and results in full product takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:17 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged remote attacker with HTTP access to fully compromise the product. The flaw is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, and Oracle classifies it as easily exploitable; no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Sites is a Java-based web experience management and content publishing platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic and exposed via HTTP/HTTPS for content authors, editors, and front-end delivery. The affected CPE oracle_corporation:oracle_webcenter_sites covers all variants of versions 12.2.1.4.0 and 14.1.2.0.0. Oracle has not published a CWE, but the combination of low-privilege HTTP access leading to full product takeover is consistent with authorization bypass, insecure direct object reference, or server-side injection flaws commonly seen in WebCenter Sites administrative and content APIs. Oracle's tag of 'Information Disclosure' understates the impact - the CVSS vector indicates full C/I/A compromise (takeover), not just data exposure.

RemediationAI

Apply the patches from Oracle's June 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - Oracle CPU patches are the only supported remediation. Until patches are deployed, restrict network access to the WebCenter Sites administrative interfaces and HTTP endpoints to trusted management networks via firewall or reverse-proxy ACLs (this will block legitimate remote authors and should be coordinated with content teams), aggressively review and disable unused low-privilege editorial accounts since PR:L is the only credential barrier, and increase web access log monitoring for anomalous authenticated request patterns from content contributor accounts. Avoid exposing WebCenter Sites delivery and management tiers on the same hostname where feasible, and ensure WebLogic and front-end WAF rules are tuned to block known WebCenter Sites attack patterns.