CVE-2026-35293: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle WebCenter Sites version 14.1.2.0.0, a component of Oracle Fusion Middleware. An attacker with network access over HTTP requires no credentials and no victim interaction to exploit this flaw. Successful exploitation results in full takeover of the affected WebCenter Sites instance, granting the attacker read, write, and availability control over the system. No fix versions have been published by Oracle; HarborGuard is tracking the advisory and will surface a patched rebuild the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites HTTP service over the network; there is no local or physical access requirement.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by any unauthenticated network caller.

• Victim interactionNot required

  No user action or social engineering is required; the attacker acts entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• A successful attacker reads all data stored in or accessible by Oracle WebCenter Sites, including site content, configuration, and any credentials held by the application.
• A successful attacker modifies or destroys persisted content, configuration records, and application state within Oracle WebCenter Sites.
• A successful attacker crashes or degrades the WebCenter Sites service, making it unavailable to legitimate users.
• Full system takeover means the attacker can pivot from the compromised instance to other systems reachable from the same host or network segment.