CVE-2026-35295
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Affected versions are 12.2.1.4.0 and 14.1.2.0.0.
Risk Assessment
An attacker can take over Oracle WebCenter Sites, potentially leading to serious breaches of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to update to the latest version of Oracle WebCenter Sites and implement appropriate security measures to restrict access to the system.
Other vulnerabilities in Oracle WebCenter Sites
See all- CVE-2017-3596High
A vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows a low privileged attacker to access critical data. The attacker can gain unauthorized access to data and has the ability to update, insert, or delete data.
- CVE-2017-3543High
A vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. The attacker can gain unauthorized access to critical data and has the ability to update, insert, or delete data.
- CVE-2017-3542High
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows unauthenticated attackers with network access via HTTP to compromise Oracle WebCenter Sites. Attackers can gain access to critical data and perform unauthorized operations on the data.
- CVE-2017-3541High
A vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks can lead to unauthorized access to critical data and complete access to all accessible data.
- CVE-2017-3540High
A vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the system. The attacker can cause hangs or frequent crashes of Oracle WebCenter Sites and gain unauthorized access to data.
- CVE-2016-3487High
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
- CVE-2026-61034Critical
Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows a high-privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-61029Critical
Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.0.
- CVE-2026-61021Critical
Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-61018Critical
Vulnerability in Oracle WebCenter Sites (component: WebCenter Sites) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
Original NVD description (English source)
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).