CVE-2026-35318: Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Synopsis

This is a high-severity vulnerability in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0), a component of Oracle Fusion Middleware. The flaw is reachable over the network via HTTP and requires only a low-privileged account to exploit, with no need for victim interaction. Successful exploitation results in full takeover of the Oracle WebCenter Sites instance, giving an attacker control over its confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory and will flag a patched rebuild the moment Oracle ships a remediated release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Sites service over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the system; anonymous access alone is not sufficient.

• Victim interactionNot required

  No user action is required; the attacker can carry out the exploit entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads all data stored in the Oracle WebCenter Sites instance, including content, configuration, and any credentials or session material held by the application.
• A successful attacker modifies or deletes persisted content, site configuration, and user data within Oracle WebCenter Sites.
• A successful attacker crashes or renders the Oracle WebCenter Sites service unavailable, disrupting content delivery for any sites it serves.
• Because the CVE description characterizes the outcome as full takeover, an attacker gains persistent control over the application process and its underlying resources.