CVE-2026-35293 is a critical security vulnerability in Oracle WebCenter Sites 14.1.2.0.0 that permits unauthenticated remote attackers to compromise the system via HTTP. The vulnerability has a CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes patches addressing this vulnerability among 245 other fixes. Oracle recommends immediate application of these patches to prevent exploitation. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to take over Oracle WebCenter Sites 14.1.2.0.0. This results in full compromise affecting confidentiality, integrity, and availability of the system. The severity is critical with a CVSS score of 9.8. No known active exploitation has been reported yet.

Oracle has released a Critical Security Patch Update in June 2026 that includes a patch for this vulnerability. Customers should apply the June 2026 Critical Security Patch Update immediately to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.