CVE-2026-35318

Awaiting Analysis Awaiting Analysis - Queue

Oracle WebCenter Sites Remote Code Execution

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Oracle

Description

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-17

Generated

2026-07-08

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-35318

EUVD

EUVD-2026-37444

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	webcenter_sites	12.2.1.4.0
oracle	webcenter_sites	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Compliance Impact

This vulnerability in Oracle WebCenter Sites allows a low privileged attacker with network access to potentially take over the system, resulting in high impacts on confidentiality, integrity, and availability.

Such a compromise could lead to unauthorized access to sensitive data, which may affect compliance with data protection regulations like GDPR and HIPAA that require safeguarding confidentiality and integrity of personal and health information.

However, specific details on how this vulnerability directly impacts compliance with these standards are not provided.

Executive Summary

This vulnerability exists in the Oracle WebCenter Sites product of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows a low privileged attacker with network access via HTTP to compromise the Oracle WebCenter Sites system.

Successful exploitation of this vulnerability can lead to a complete takeover of the Oracle WebCenter Sites application.

Impact Analysis

The impact of this vulnerability is severe, as it can result in the attacker gaining full control over the Oracle WebCenter Sites system.

Confidentiality impact: High - sensitive information could be exposed.
Integrity impact: High - data could be altered or corrupted.
Availability impact: High - the system could be disrupted or taken offline.

Hi! I’m here to help you understand CVE-2026-35318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70