CVE-2026-35293: Critical severity Oracle Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Sites' HTTP interface: block or allow only trusted IP ranges at the firewall/ACLs, place the servers on an isolated/internal network or behind a VPN, and deploy a Web Application Firewall (WAF) to detect and block exploit attempts against WebCenter Sites.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35293?
The severity of CVE-2026-35293 is critical with a score of 9.8.
How do I fix CVE-2026-35293?
To fix CVE-2026-35293, upgrade to the latest version of Oracle WebCenter Sites that is not affected.
Who is affected by CVE-2026-35293?
CVE-2026-35293 affects users of Oracle WebCenter Sites version 14.1.2.0.0.
What type of attack does CVE-2026-35293 allow?
CVE-2026-35293 allows unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites.
What components are involved in CVE-2026-35293?
CVE-2026-35293 involves the Oracle WebCenter Sites component of Oracle Fusion Middleware.