What is the CVSS score of CVE-2026-35317?

CVE-2026-35317 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35317?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity account takeover vulnerability (CVSS 8.8) with no public exploit identified at time of analysis, but the vendor's…

Is there a public PoC exploit available for CVE-2026-35317?

Yes, a public proof-of-concept exploit is available for CVE-2026-35317. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-35317?

Within 24 hours: Identify all systems running affected versions (12.2.1.4.0 and 14.1.2.0.0); restrict network access to Content Server component to essential users and systems only; enforce strong password policies and enable multi-factor authentication where operationally feasible. Within 7 days: Complete network segmentation implementation, rotate credentials for all WebCenter Content administrative and service accounts, enable comprehensive audit logging for authentication and privilege changes. Within 30 days: Monitor Oracle security advisories for patch release; establish staging environment to test patch immediately upon availability; schedule emergency deployment within 48 hours of patch availability.

Oracle WebCenter Content CVE-2026-35317

EUVD-2026-37443 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable Content Server (AV:N), no special conditions (AC:L), requires any low-privileged WebCenter account (PR:L), no user interaction, and vendor states full takeover so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:18 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the Content Server component. Oracle rates the flaw 8.8 with high impact across confidentiality, integrity and availability, and characterizes it as easily exploitable. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the vendor's 'takeover' wording and low complexity make this a priority patch.

Technical ContextAI

Oracle WebCenter Content (formerly Oracle UCM/Stellent) is the enterprise content management platform within Oracle Fusion Middleware, used for documents, records and digital asset management. The vulnerable component is the Content Server, the core J2EE application that handles HTTP-based check-in, retrieval, search and administration services. CPE data confirms the affected product family (cpe:2.3:a:oracle_corporation:oracle_webcenter_content), and the supported affected versions are the 12.2.1.4.0 line and the newer 14.1.2.0.0 release. The CWE is not assigned by Oracle, which is typical for their CPU advisories; based on the 'takeover' outcome with PR:L and no UI, the root cause class is most likely an authorization/authentication bypass or unsafe handler exposed to authenticated low-privileged Content Server users.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; treat this as Patch available per vendor advisory because Oracle CPUs ship bundle patches rather than individual version increments. Until the CPU is applied, restrict network access to the Content Server HTTP endpoints to trusted management subnets via firewall or reverse-proxy ACLs (side effect: breaks external check-in/retrieval workflows and remote WebCenter clients), tighten role assignments so that the 'low privileged' Content Server roles (e.g. contributor/consumer) are granted only to vetted users (side effect: may interrupt onboarding/self-service document workflows), and increase audit logging on Content Server administrative and check-in handlers to detect anomalous use by low-privilege accounts (side effect: log volume and storage growth). Validate the CPU on a non-production WebCenter Content instance before rolling to production because Fusion Middleware bundle patches occasionally require schema or RCU updates.