Oracle WebCenter Content CVE-2026-35320

No authentication and no user interaction are required (PR:N, UI:N) and the attack is delivered over the network via HTTP against the Oracle WebCenter Content Server component, but exploitation is gated by AC:H - Oracle classifies the attack as difficult, meaning the attacker must satisfy conditions outside their direct control such as a specific server state, timing window, or non-default Content Server configuration to land the takeover. Exploitation is limited to deployments running exactly Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 with the Content Server's HTTP interface reachable by the attacker; instances behind strict network segmentation, or where the Content Server HTTP listener is not exposed to the attacker's network, are not realistically reachable.

This vulnerability mixes critical and mitigating signals that defenders must weigh carefully. The CVSS 3.1 base score of 9.0 with AV:N/PR:N/UI:N and full C/I/A impact plus scope change marks it as a top-tier remediation priority, especially because Oracle WebCenter Content is frequently exposed to internal networks holding sensitive documents and is often integrated with identity and database backends that the scope change can reach. Offsetting that, AC:H tells us exploitation requires conditions outside the attacker's control (timing, configuration, or specific state), and there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data provided - suggesting it is not yet seeing opportunistic mass exploitation. Oracle CPU vulnerabilities historically attract reverse-engineering after each quarterly release, so the window between patch availability and weaponization is typically weeks, not months; treat as high priority for any internet-exposed or DMZ-deployed WebCenter Content instance. Missing CWE, missing EPSS, and Oracle's standard non-disclosure of root cause limit independent verification of the exact attack mechanics.

An attacker reaches the Content Server HTTP endpoint over the network without credentials and sends a crafted request sequence that triggers the high-complexity condition (likely state-dependent or requiring a race/specific configuration), achieving full takeover of WebCenter Content and pivoting through its scope-changing trust relationships into adjacent Fusion Middleware components such as WebLogic or the backing identity store. No public exploit identified at time of analysis, so this scenario assumes a skilled attacker who has reverse-engineered the June 2026 CPU patch.