CVE-2026-35295: Oracle WebCenter Sites Privilege Escalation

CVE-2026-35295 Overview

CVE-2026-35295 affects Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The vulnerability impacts supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the product, though the attack complexity is high. Successful exploitation results in full takeover of Oracle WebCenter Sites, with high impact on confidentiality, integrity, and availability.

The issue maps to CWE-306 (Missing Authentication for Critical Function). Oracle addressed the flaw in its June 2026 Critical Patch Update.

Critical Impact
Successful exploitation leads to complete takeover of Oracle WebCenter Sites, exposing all hosted content management data and operations.

Affected Products

Oracle WebCenter Sites 12.2.1.4.0
Oracle WebCenter Sites 14.1.2.0.0
Oracle Fusion Middleware deployments incorporating WebCenter Sites

Discovery Timeline

2026-06-17 - CVE-2026-35295 published to NVD
2026-06-17 - Oracle releases security patch as part of Oracle Security Alert June 2026
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35295

Vulnerability Analysis

The vulnerability resides in the WebCenter Sites component of Oracle Fusion Middleware. An authenticated attacker holding low-privilege credentials can interact with the affected service over HTTP. By chaining requests that bypass authentication checks on a critical function, the attacker escalates control to full product takeover.

The weakness is classified under CWE-306, indicating a critical function is reachable without enforcement of complete authentication. While the attack complexity is high, requiring specific conditions or timing, the resulting impact spans confidentiality, integrity, and availability. The EPSS probability is 0.311% at the 22.6th percentile, indicating low predicted exploitation activity at publication.

Root Cause

The root cause is missing authentication enforcement on a sensitive code path within WebCenter Sites. A function that should require strong authentication is reachable to lower-privileged sessions, allowing an attacker to invoke administrative behavior outside the intended trust boundary.

Attack Vector

Exploitation occurs remotely over HTTP. The attacker requires network reachability to the WebCenter Sites application and a low-privileged account on the platform. No user interaction is needed. Because the scope is unchanged and impacts are high across the CIA triad, a single successful chain yields administrative-level control of the WebCenter Sites instance.

No public proof-of-concept code is available. The vulnerability mechanism is described in prose only; refer to the Oracle Security Alert June 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-35295

Indicators of Compromise

Unexpected HTTP requests to WebCenter Sites administrative or content management endpoints originating from low-privileged user sessions.
Creation or modification of WebCenter Sites assets, templates, or users without corresponding administrative session logs.
Outbound connections or new scheduled tasks initiated by the WebCenter Sites application server process after suspicious HTTP activity.

Detection Strategies

Correlate WebCenter Sites access logs with authentication events to identify sessions invoking privileged operations without matching admin authentication.
Baseline normal HTTP method and URI patterns per user role, then alert on deviations against the WebCenter Sites application.
Monitor Fusion Middleware audit logs for privilege changes, template edits, or configuration writes performed by non-administrator accounts.

Monitoring Recommendations

Forward WebCenter Sites, WebLogic, and reverse-proxy logs into a centralized SIEM for cross-source correlation.
Enable verbose audit logging on WebCenter Sites administrative APIs and retain logs for incident review.
Alert on anomalous spikes in HTTP 200 responses to administrative URIs paired with non-administrative session identifiers.

How to Mitigate CVE-2026-35295

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update for WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0.
Inventory all Oracle Fusion Middleware deployments to confirm patch coverage across production, staging, and disaster-recovery environments.
Rotate credentials for any low-privileged WebCenter Sites accounts that could have been abused prior to patching.

Patch Information

Oracle published the fix in the June 2026 Critical Patch Update. Administrators should download and apply the relevant patches as documented in the Oracle Security Alert June 2026. Validate patch installation by checking the WebCenter Sites build version and reviewing Oracle's post-installation steps.

Workarounds

Restrict network access to WebCenter Sites administrative interfaces using firewall rules or a reverse proxy allow list.
Place WebCenter Sites behind an authenticating web application firewall that enforces role-based access control on sensitive URIs.
Disable or remove low-privileged accounts that are not required for business operations until patching is complete.

bash

# Example: restrict WebCenter Sites admin paths at the reverse proxy
location ~* ^/(cs|sites)/(Satellite|ContentServer)/admin {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://webcenter_backend;
}