What is the CVSS score of CVE-2026-35315?

CVE-2026-35315 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35315?

Oracle WebCenter Content systems running versions 12.2.1.4.0 or 14.1.2.0.0 are exposed to account takeover and complete platform compromise, permitting low-privileged attackers to access all…

How to fix or mitigate CVE-2026-35315?

Within 24 hours: Identify all deployments of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 across production and non-production environments. Within 7 days: Restrict network access to WebCenter Content servers via firewall whitelisting; enforce additional authentication controls and multi-factor authentication where supported; enable comprehensive audit logging of authentication and administrative events. Within 30 days: Monitor Oracle Critical Security Patch Update advisories for patch release and develop tested upgrade procedures to patched versions when available; evaluate interim operational measures such as taking the Content Server component offline if feasible.

Oracle WebCenter Content CVE-2026-35315

EUVD-2026-37441 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTP endpoint (AV:N), Oracle states easily exploitable (AC:L), requires a low-privileged WebCenter account (PR:L), no user interaction, and full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:41 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) lets a low-privileged remote attacker fully compromise the platform over HTTP without user interaction. Oracle's own CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, and there is no public exploit identified at time of analysis. Disclosed via the Oracle Critical Security Patch Update advisory (cspujun2026), making this a vendor-confirmed flaw rather than third-party speculation.

Technical ContextAI

Oracle WebCenter Content (formerly Oracle UCM/Stellent) is an enterprise content management platform whose Content Server component handles document ingestion, metadata indexing, check-in/check-out workflows, and HTTP-based access to stored records - frequently deployed as a backbone for regulated documents, contracts, and records management in Fusion Middleware stacks. The CPE 'cpe:2.3:a:oracle_corporation:oracle_webcenter_content' confirms the application-tier product is in scope rather than the underlying WebLogic container, and the 'Information Disclosure' tag combined with full C/I/A:H impact suggests an authenticated abuse of a Content Server HTTP endpoint that exposes privileged operations to lower-tier users. No CWE was assigned, so the precise weakness class (authorization bypass, insecure deserialization, or injection) is not disclosed by Oracle, which is typical of CPU advisories that withhold technical detail until patches propagate.

RemediationAI

Apply the Oracle Critical Patch Update of June 2026 for Fusion Middleware, which is the patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle has not published a discrete fix-version string in the supplied data, so consult the CPU patch matrix for the exact bundle ID corresponding to your 12.2.1.4.0 or 14.1.2.0.0 deployment. Until the CPU is applied, restrict network reachability of the Content Server HTTP/HTTPS listeners to trusted management networks via firewall or reverse-proxy ACLs (side effect: breaks legitimate remote portal users and any federated WebCenter Portal/WebCenter Sites integrations), and tighten user provisioning so that low-privileged WebCenter accounts are not handed out broadly (side effect: may block self-service registration flows). Increase audit logging on Content Server administrative and check-in endpoints and review for anomalous low-privilege account activity, but recognize that without a CWE or public POC, signature-based detection is not feasible and compensating controls only reduce - not eliminate - exposure.