What is the CVSS score of CVE-2026-35270?

CVE-2026-35270 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35270?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a CRITICAL privilege-escalation vulnerability (CVE-2026-35270, CVSS 9.1) permitting authenticated high-privilege users to fully…

How to fix or mitigate CVE-2026-35270?

24 hours: Identify all Oracle WebCenter Content deployments running 12.2.1.4.0 or 14.1.2.0.0; restrict administrative access and review recent high-privilege account activity for compromise indicators. 7 days: Implement network segmentation limiting HTTP/HTTPS access to WebCenter Content to essential users only; disable unused administrative accounts; activate comprehensive audit logging for all privileged actions. 30 days: Escalate to Oracle support for patch timeline; begin migration planning to patched versions when released; complete vulnerability assessment of all connected Fusion Middleware components.

Oracle WebCenter Content CVE-2026-35270

EUVD-2026-37401 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

HTTP-reachable Content Server (AV:N, AC:L), requires admin-level Content Server account (PR:H), no UI, takeover plus impact on adjacent products gives S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privileged takeover of Oracle WebCenter Content (Content Server component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, enabling a high-privileged attacker with HTTP network access to fully compromise the instance and pivot to additional Fusion Middleware products via a scope change. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting low attack complexity and full CIA impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform in the Fusion Middleware stack, used for documents, records, digital assets, and imaging. The vulnerable component is the Content Server, which exposes administrative and content APIs over HTTP/HTTPS and integrates with WebLogic, IDM, and other Fusion Middleware services. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*:*:*:*:*:*:*:*, combined with the advisory text, scopes impact to the 12.2.1.4.0 and 14.1.2.0.0 branches. No CWE has been assigned by Oracle, but the scope-change (S:C) plus full CIA impact pattern in Oracle CPU advisories typically corresponds to authenticated abuse of a privileged Content Server function that can reach trust-bounded resources such as the underlying WebLogic domain or shared datastores.

RemediationAI

Patch available per vendor advisory: apply the fixes for Oracle WebCenter Content shipped in the June 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to both the 12.2.1.4.0 and 14.1.2.0.0 branches, following Oracle's standard CPU prerequisites and the WebCenter Content patch readme. Until the CPU is applied, reduce the population of accounts with administrative or privileged Content Server roles, rotate any shared admin credentials, and restrict HTTP/HTTPS access to the Content Server admin endpoints to a management VLAN or jump-host - accepting the trade-off that legitimate remote administration workflows will need to traverse that path. Enable and centrally collect Content Server and WebLogic audit logs to detect anomalous use of privileged operations, and review trust relationships with adjacent Fusion Middleware products given the scope-change nature of the bug.