CVE-2026-35318: Oracle WebCenter Sites Privilege Escalation (CVSS 8.8)

Technical summary

CVE-2026-35318 is a CWE-284 (Improper Access Control) vulnerability in Oracle WebCenter Sites. The flaw has a low attack complexity and requires only low privilege access to trigger, making it particularly dangerous in multi-tenant or shared hosting scenarios where legitimate user accounts are commonplace. The vulnerability is network-accessible via HTTP and requires no user interaction. When successfully exploited, an attacker gains the same privileges and access as the victim, with potential for full system compromise given WebCenter Sites' role as a content management system.

Business impact

Compromise of WebCenter Sites creates significant business risk. Attackers could steal confidential content, alter published materials, inject malicious code, or disable the platform entirely. For organizations using WebCenter Sites for customer-facing content delivery or internal collaboration, this could result in reputational damage, compliance violations, and operational downtime. The ease of exploitation—requiring only a low-privileged account and network access—means insider threats or compromised user credentials become immediate attack vectors.

Affected systems

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected. Organizations running these specific versions should prioritize assessment and remediation. Later versions may have remediation available; verify your deployment version and consult Oracle's security advisory for the complete list of patched versions.

Exploitability

This vulnerability is highly exploitable. It requires only network access and low-privilege credentials—conditions typically met in most organizational environments where WebCenter Sites serves multiple users. The low attack complexity and absence of user interaction requirements mean attacks could be automated and scaled. However, since an initial valid user account is necessary, the threat is elevated among organizations where user provisioning is loose or where compromised credentials circulate.

Remediation

Apply security patches from Oracle addressing CVE-2026-35318 immediately. Contact your Oracle support account or consult Oracle's June 2026 Critical Patch Update advisories for specific patch versions targeting your deployment version. Test patches in a staging environment before production rollout to ensure compatibility with custom WebCenter Sites configurations. Consider also reviewing and restricting low-privilege user access levels to limit the scope of lateral movement if initial compromise occurs.

Patch guidance

Check Oracle's June 2026 Critical Patch Update announcements for patches addressing this CVE for your specific version of WebCenter Sites. Verify patch compatibility with any custom extensions or integrations before applying. Plan a maintenance window for production systems, as some patches may require service restart. Document your baseline configuration and have rollback procedures ready in case unforeseen issues arise during patching.

Detection guidance

Monitor WebCenter Sites logs for unusual privilege escalation attempts, unexpected administrative actions originating from low-privilege accounts, and anomalous HTTP requests to privileged endpoints. Review access logs for accounts making requests inconsistent with their role. Inspect authentication and authorization logs for failed escalation attempts that may indicate exploitation probing. Set alerts on successful privilege elevation events and bulk content modifications by normally-restricted users.

Why prioritize this

This vulnerability scores CVSS 8.8 (HIGH) and combines ease of exploitation with complete system compromise potential. The low barrier to initial access—requiring only a valid user account—makes it a high-priority target for threat actors. Given the centrality of content management systems to many organizations' operations, swift patching prevents both immediate compromise and lateral movement risks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the combination of network accessibility, low attack complexity, minimal privilege requirements, and severe impact across confidentiality, integrity, and availability. While an attacker needs a valid account (reducing score from critical), the ease of obtaining such credentials through hiring, phishing, or credential stuffing means the practical risk is severe. The lack of current KEV status does not diminish the vulnerability's urgency given its exploitability profile.

Frequently asked questions