Oracle WebCenter Sites CVE-2026-35318

Requires network HTTP/HTTPS reachability to an Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 instance and one valid low-privileged account on that instance (CVSS PR:L) - fully unauthenticated exploitation is not indicated. No user interaction, no special non-default configuration, and no platform-specific prerequisites are called out by Oracle; scope is unchanged (S:U), so impact is contained to the WebCenter Sites product itself. Exploitation is limited primarily by whether the application is reachable from the attacker's network position and whether they can obtain any authenticated session, however weak.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-priority issue: network-reachable, low-complexity, no user interaction, and only a single low-privileged account required to achieve full takeover. Oracle explicitly calls it 'easily exploitable,' which strengthens the case for urgent patching of any internet- or partner-network-facing WebCenter Sites instance. The vulnerability is not currently listed in CISA KEV and no public POC has been identified, and EPSS data was not provided, so likelihood of mass exploitation is currently unquantified - however, Oracle Critical Patch Update issues historically see targeted exploitation within weeks of disclosure, particularly against Fusion Middleware. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H impact in the CVSS vector; defenders should trust the vector and Oracle's 'takeover' language over the tag.

An attacker who has obtained or registered any low-privileged WebCenter Sites account (e.g., a content contributor, a leaked partner credential, or a self-service editorial role) sends crafted HTTP requests to the WebCenter Sites application and escalates to full product takeover, gaining the ability to publish arbitrary content, exfiltrate managed assets, or pivot into the underlying Fusion Middleware host. No user interaction is required and the attack complexity is low, making credential reuse and phished editorial logins a realistic entry path; no public exploit identified at time of analysis.