What is the CVSS score of CVE-2026-35286?

CVE-2026-35286 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35286?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete system takeover without authentication via HTTP.

How to fix or mitigate CVE-2026-35286?

Within 24 hours: Inventory all WebCenter Content deployments; identify systems exposed to untrusted networks and prioritize isolation. Within 7 days: Implement firewall rules restricting HTTP access to WebCenter Content to trusted sources only; enable detailed access logging on affected instances. Within 30 days: Monitor Oracle security advisories for patched versions (12.2.1.5.0, 14.1.3.0.0, or later); develop and test upgrade timeline with Oracle support.

Oracle WebCenter Content CVE-2026-35286

EUVD-2026-37415 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states easily exploitable, unauthenticated, network HTTP access with no user interaction, yielding full takeover - confidentiality, integrity, and availability all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:27 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to fully compromise the Content Server component via HTTP, with no public exploit identified at time of analysis. The CVSS 9.8 score reflects complete confidentiality, integrity, and availability impact, and Oracle disclosed the issue in its June 2026 Critical Patch Update. Organizations running Fusion Middleware-based content management should treat this as a top-priority patching item given the trivial attack complexity.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, built on the Content Server component that handles document ingestion, metadata indexing, workflow, and HTTP-based delivery via the IdcCommand/IDC protocol and web UI. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*:*:*:*:*:*:*:* covers all builds, with Oracle's advisory specifying 12.2.1.4.0 (12c) and 14.1.2.0.0 (14c) as in-support affected versions. No CWE was assigned, but the combination of unauthenticated network reach plus full takeover is consistent with the deserialization, authentication bypass, or server-side request handling flaws historically reported against the WebLogic-hosted Content Server stack.

RemediationAI

Apply the Oracle June 2026 Critical Patch Update (cspujun2026) immediately to both 12.2.1.4.0 and 14.1.2.0.0 installations per https://www.oracle.com/security-alerts/cspujun2026.html; this is the patch status 'Patch available per vendor advisory' with no separately confirmed point-release number in the supplied data. Until patching is complete, restrict network exposure of the Content Server HTTP endpoints to trusted management networks via firewall or reverse-proxy ACLs, place the deployment behind an authenticating WAF that blocks anonymous access to /cs/, /idcplg, and IdcCommand paths, and increase logging on the Content Server access logs to detect anomalous unauthenticated requests - the trade-off is that legitimate external integrations or partner ingest flows relying on anonymous endpoints may break and require reconfiguration. Disabling unused Content Server components and verifying no IdcCommand services are exposed to the public internet further reduces attack surface.