CVE-2026-35318 is a vulnerability in Oracle WebCenter Sites (Oracle Fusion Middleware component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access over HTTP to compromise the system, potentially leading to complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (8.8 base score). The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. The advisory strongly urges customers to apply patches without delay and provides some mitigation suggestions such as blocking attack-required network protocols and removing unnecessary privileges, though these may impact application functionality. The vendor advisory is the authoritative source for patch availability and remediation guidance.

Successful exploitation of CVE-2026-35318 can lead to complete compromise of Oracle WebCenter Sites, affecting confidentiality, integrity, and availability of the system. This means an attacker could potentially take over the affected system, access sensitive data, modify or delete data, and disrupt service availability. The vulnerability is exploitable by a low privileged attacker with network access via HTTP, increasing the risk of exploitation in network-exposed environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Customers should remain on actively supported versions and apply security patches promptly to mitigate risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these workarounds may impact application functionality. Patch status is not explicitly confirmed in the input data; users must consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.