What is the CVSS score of CVE-2026-35319?

CVE-2026-35319 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35319?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote system takeover via the Content Server component, with a critical CVSS 9.8 score.

How to fix or mitigate CVE-2026-35319?

Within 24 hours: Audit all Oracle WebCenter Content deployments; restrict network access to Content Server endpoints via firewall rules, limiting connectivity to trusted internal networks only. Within 7 days: Engage Oracle support to confirm patch timeline and escalate to Fusion Middleware management; implement real-time monitoring and alerting on all WebCenter Content access. Within 30 days: Apply vendor patch immediately upon release, or migrate to patched versions 12.2.1.4.1 or 14.1.2.0.1 (when available) if inventory confirms exposure.

Oracle WebCenter Content CVE-2026-35319

EUVD-2026-37445 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated network HTTP exploitation is easy and results in full product takeover, justifying AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:17 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible via the Content Server component over HTTP, scored CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a high-priority patch target for any Oracle Fusion Middleware environment exposing WebCenter Content.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, used for document management, records management, and digital asset management. The vulnerable component is the Content Server, which exposes HTTP-based services for content ingest, retrieval, and administration. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers both affected releases. No CWE was assigned by Oracle, which is typical of Oracle CPU disclosures that withhold root-cause class to limit reverse-engineering; given the unauthenticated network vector with full CIA impact, the underlying flaw is most likely an authentication bypass, deserialization, or injection issue in an HTTP-exposed Content Server endpoint, but the specific class cannot be confirmed from the available data.

RemediationAI

Apply the Oracle Critical Patch Update for June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for both 12.2.1.4.0 and 14.1.2.0.0 - Oracle CPU patches are cumulative, so install the full CPU bundle rather than only the WebCenter component fix. Until the CPU is deployed, restrict HTTP access to the Content Server to known administrative networks via firewall or reverse-proxy ACLs, place the deployment behind a WAF with rules blocking anomalous Content Server URIs (recognizing WAF rules cannot reliably block an unspecified flaw and may break legitimate ingest workflows), and disable any internet-facing exposure of the Content Server admin endpoints. Increase logging on the Content Server HTTP layer and monitor for unauthenticated POST traffic to non-public endpoints; note that network restriction will impact remote contributors and integrations that rely on direct Content Server connectivity.