CVE-2026-35296: Critical severity Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block external HTTP access to Oracle WebCenter Sites instances (e.g., via web server config or firewall rules) until a vendor fix is applied.
Oracle WebCenter Sites HTTP access = disabled for external networks - Compensating control
Place Oracle WebCenter Sites behind a firewall, VPN, or web application firewall (WAF); restrict access to management and HTTP endpoints to trusted IP ranges only to prevent unauthenticated network access.
- Operational
If any internet-accessible Oracle WebCenter Sites instances are found, isolate them from the network, perform an incident response investigation for signs of compromise (log review, integrity checks), restore impacted systems from known-good backups if needed, and rotate any credentials, API keys, or secrets that could have been exposed.
- Operational
Contact Oracle Support or your vendor representative for official mitigation guidance and apply any vendor-supplied patches or mitigations as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35296?
CVE-2026-35296 has a critical severity score of 9.8.
How do I fix CVE-2026-35296?
To fix CVE-2026-35296, upgrade to the patched versions of Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0.
Who is affected by CVE-2026-35296?
CVE-2026-35296 affects users of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0.
What type of attack does CVE-2026-35296 enable?
CVE-2026-35296 allows unauthenticated attackers with network access to compromise Oracle WebCenter Sites via HTTP.
What impact does CVE-2026-35296 have on data confidentiality and integrity?
CVE-2026-35296 can lead to complete compromise of confidentiality and integrity of data managed by affected Oracle WebCenter Sites.