CVE-2026-35318: High severity Oracle Oracle WebCenter Sites vulnerability
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or restrict HTTP/HTTPS access to Oracle WebCenter Sites (limit to management network or specific trusted IP ranges) until an official vendor fix is available and applied.
Oracle WebCenter Sites HTTP access = disabled or restricted to trusted IPs - Compensating control
Restrict network access to Oracle WebCenter Sites (which is exploitable via HTTP) by limiting inbound HTTP/HTTPS to trusted IPs using firewalls or network ACLs, and/or place the service behind a WAF. Block direct Internet access to the service until a vendor patch is applied.
- Operational
Monitor Oracle security advisories for a vendor-supplied patch for Oracle WebCenter Sites and apply the patch immediately when available. If compromise is suspected, follow incident response procedures (isolate affected hosts, investigate, and rotate credentials/keys used by the affected systems).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35318?
The severity of CVE-2026-35318 is rated high with a score of 8.8.
How do I fix CVE-2026-35318?
To fix CVE-2026-35318, you should update your Oracle WebCenter Sites to the latest supported version.
What components of Oracle are affected by CVE-2026-35318?
CVE-2026-35318 affects the Oracle WebCenter Sites component of Oracle Fusion Middleware.
Who can exploit CVE-2026-35318?
CVE-2026-35318 can be exploited by a low privileged attacker with network access via HTTP.
Which versions of Oracle WebCenter Sites are vulnerable to CVE-2026-35318?
The vulnerable versions of Oracle WebCenter Sites are 12.2.1.4.0 and 14.1.2.0.0.