CVE-2026-35295 affects Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 and is characterized by a difficult-to-exploit vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can result in complete takeover of Oracle WebCenter Sites. The vulnerability has a CVSS 3.1 base score of 7.5 with high confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. Oracle advises customers to apply these patches without delay to prevent exploitation. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt application functionality.

If exploited, this vulnerability can lead to full compromise of Oracle WebCenter Sites, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches from this update promptly. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by Oracle's advisory; applying the official patch is the recommended remediation.