CVE-2026-35296: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

A critical unauthenticated remote compromise vulnerability affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, a component of Oracle Fusion Middleware. The flaw is reachable over HTTP from any network, requires no login, no victim interaction, and no special conditions to exploit reliably. Successful exploitation gives an attacker full takeover of the WebCenter Sites instance, covering complete loss of confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites HTTP interface over a network; the service is exposed remotely with no requirement for a privileged network position.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the attacker interacts with the service as an anonymous HTTP client.

• Victim interactionNot required

  The attack is fully server-side; no user of the application needs to click a link, open a file, or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions, memory-layout dependencies, or environmental prerequisites.

Blast Radius

• A successful attacker achieves full control of the Oracle WebCenter Sites process, including the ability to read all stored content, configuration, credentials, and session data.
• The attacker can modify or delete any persisted content, site configuration, or database records managed by the WebCenter Sites application.
• The attacker can crash or permanently disable the WebCenter Sites service, making managed web properties unavailable.
• Because the CVSS scope is unchanged, lateral movement beyond the WebCenter Sites boundary depends on host-level privilege and network topology, but the application itself is completely compromised.