What is the CVSS score of CVE-2026-35316?

CVE-2026-35316 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35316?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical account takeover vulnerability (CVSS 9.9) that allows low-privileged users to compromise the application and pivot to…

How to fix or mitigate CVE-2026-35316?

Within 24 hours: Identify all WebCenter Content deployments running versions 12.2.1.4.0 or 14.1.2.0.0; review authentication logs for suspicious low-privileged account activity. Within 7 days: Implement network segmentation isolating WebCenter Content from production systems; enforce multi-factor authentication for all accounts; deploy real-time alerting for failed authentication attempts and privilege escalation. Within 30 days: Obtain patch availability timeline from Oracle; if patched versions are not available within 90 days, implement application-layer access controls and strengthen monitoring for lateral movement.

Oracle WebCenter Content CVE-2026-35316

EUVD-2026-37442 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable Content Server (AV:N, AC:L), requires a low-privileged WebCenter account (PR:L), no user interaction, full takeover with documented cross-product scope change (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:19 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privileged remote attacker to compromise the application over HTTP and pivot to other products via a scope change. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting easy exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, providing document management, records management, digital asset management, and imaging via the Content Server component that exposes web-based services over HTTP. The CPE 'cpe:2.3:a:oracle_corporation:oracle_webcenter_content' confirms the affected stack is the Content Server tier, which is typically deployed on WebLogic and integrates with identity providers, databases, and downstream Fusion Middleware components - explaining how a flaw here can produce a CVSS scope change to other products. No CWE is assigned in the available data, but the combination of low-privileged HTTP access producing full takeover and cross-product impact is consistent with weaknesses such as broken access control or insecure deserialization commonly seen in Oracle Critical Patch Update advisories.

RemediationAI

Apply the patches shipped in the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; the input does not name an exact post-patch build, so refer to the CPU advisory for the precise bundle/patch number for your platform. Until patching is possible, restrict network exposure of the Content Server HTTP endpoints to trusted networks via WAF or reverse proxy ACLs, tighten the low-privilege roles that can authenticate to WebCenter Content (review contributor/self-service accounts, disable anonymous or guest write paths), and increase auditing on Content Server request logs - note these compensating controls do not address the underlying flaw and may break legitimate contributor workflows, so they are a stopgap only.