CVE-2026-35293: Oracle WebCenter Sites Auth Bypass Flaw

CVE-2026-35293 Overview

CVE-2026-35293 is a critical vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to fully compromise the application. Oracle classifies the issue as easily exploitable, meaning no special conditions or user interaction are required. Successful exploitation results in complete takeover of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability. The vulnerability maps to CWE-306, Missing Authentication for a Critical Function. Oracle disclosed the issue in its June 2026 Critical Security Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebCenter Sites instances over HTTP without user interaction.

Affected Products

Oracle WebCenter Sites 14.1.2.0.0
Oracle WebCenter Sites 12.2.1.4.0
Oracle Fusion Middleware deployments embedding the affected WebCenter Sites component

Discovery Timeline

2026-06-17 - CVE-2026-35293 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Security Patch Update

Technical Details for CVE-2026-35293

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. An attacker reaches the vulnerable code path over the network using HTTP without authenticating. Oracle's advisory indicates the flaw permits full takeover of the WebCenter Sites instance, meaning attackers can read content, modify it, and disrupt service. The CWE classification of Missing Authentication for a Critical Function indicates that a sensitive operation is reachable without verifying the requester's identity. The CVSS vector reflects an unauthenticated, network-exploitable issue with high impact across confidentiality, integrity, and availability. EPSS data for this CVE is 0.483% at the 37.8 percentile as of 2026-06-18, which can change as public exploitation details emerge.

Root Cause

The root cause is an authentication control gap on a sensitive WebCenter Sites function. Oracle has not published technical specifics beyond the advisory entry. Based on the CWE-306 classification, a critical request handler accepts and processes input without first validating the caller's session or credentials.

Attack Vector

The attack vector is network-based over HTTP. An attacker reaches the affected WebCenter Sites endpoint from any host that can connect to the application's listener. No credentials, prior access, or user interaction are required. Internet-exposed WebCenter Sites instances are at the highest risk. Oracle has not released public proof-of-concept code, and CISA KEV does not list the vulnerability at this time.

No verified exploit code is publicly available. Refer to the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-35293

Indicators of Compromise

Unauthenticated HTTP requests to WebCenter Sites administrative or content management endpoints from unexpected source addresses.
New or modified administrative accounts, content templates, or site assets created without a corresponding authenticated session in audit logs.
Outbound connections from the WebCenter Sites JVM process to unfamiliar hosts following inbound HTTP traffic.
Unexpected java child processes or shell invocations spawned by the WebCenter Sites application server.

Detection Strategies

Inspect web access logs for high-volume or unauthenticated requests to WebCenter Sites endpoints, especially POST requests returning 200 without a prior authenticated session cookie.
Compare WebCenter Sites configuration, templates, and user lists against a known-good baseline to surface unauthorized modifications.
Correlate web server access logs with application server audit logs to identify privileged actions performed without a corresponding login event.

Monitoring Recommendations

Forward Oracle Fusion Middleware, WebLogic, and WebCenter Sites logs to a centralized SIEM and alert on anomalous administrative actions.
Monitor egress traffic from middleware hosts for connections to non-corporate destinations.
Track process creation on application servers and alert when the JVM spawns interactive shells, scripting interpreters, or download utilities.

How to Mitigate CVE-2026-35293

Immediate Actions Required

Apply the fixes from Oracle's June 2026 Critical Patch Update to all WebCenter Sites 14.1.2.0.0 and 12.2.1.4.0 deployments.
Inventory all internet-reachable WebCenter Sites instances and remove direct exposure where business requirements allow.
Review administrative accounts, content templates, and recent configuration changes for unauthorized modifications.
Rotate credentials, API keys, and secrets stored within or accessible from the WebCenter Sites environment if compromise is suspected.

Patch Information

Oracle addresses CVE-2026-35293 in the June 2026 Critical Security Patch Update. Administrators should download and apply the patch bundle for their WebCenter Sites version from My Oracle Support, following the deployment guidance in the Oracle Security Alert. Patching is the only vendor-supported remediation.

Workarounds

Restrict HTTP access to WebCenter Sites with network ACLs, allowing only trusted administrative and content delivery sources until patching completes.
Place a web application firewall in front of WebCenter Sites and block unauthenticated requests to administrative paths.
Disable or isolate non-essential WebCenter Sites services that are not required for production content delivery.

bash

# Example: restrict WebCenter Sites administrative paths at a reverse proxy (NGINX)
location ~* ^/(cs|sites|webcenter)/admin {
    allow 10.0.0.0/8;       # corporate admin network
    deny  all;
    proxy_pass http://webcenter_sites_backend;
}