What is the CVSS score of CVE-2026-35321?

CVE-2026-35321 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35321?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 face critical risk from a remotely exploitable vulnerability (CVSS 9.9) allowing low-privilege authenticated users to achieve complete…

How to fix or mitigate CVE-2026-35321?

Within 24 hours: Restrict network access to all WebCenter Content instances to internal/trusted IP ranges only and audit active user accounts with Content Server permissions. Within 7 days: Implement network segmentation isolating WebCenter Content from other Fusion Middleware components, deploy host-based intrusion detection, and enable comprehensive authentication/content-access logging. Within 30 days: Establish vendor patch monitoring protocol for CVE-2026-35321 remediation; coordinate testing and deployment timeline for patched versions (12.2.1.x, 14.1.2.x) across production, staging, and non-critical instances.

Oracle WebCenter Content CVE-2026-35321

EUVD-2026-37447 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable Content Server (AV:N), easily exploitable per Oracle (AC:L), requires a low-privileged account (PR:L), no user interaction, and full takeover with cross-product impact justifies S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:16 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HTTP, with scope change enabling impact on adjacent products in the Fusion Middleware stack. The flaw carries a CVSS 3.1 base score of 9.9 and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis. Authenticated access to the Content Server is the only meaningful barrier, making this a high-priority patch item for enterprises using WebCenter Content for document management.

Technical ContextAI

Oracle WebCenter Content (formerly Oracle UCM/Stellent) is an enterprise content management platform built on top of WebLogic Server, providing document management, records management, and digital asset management capabilities. The vulnerable Content Server component handles HTTP-based interactions for check-in, retrieval, and workflow operations, and is typically integrated with broader Oracle Fusion Middleware deployments. CWE is not assigned by Oracle, but the combination of low-privileged HTTP exploitation, scope change, and full CIA impact is characteristic of authenticated injection, unsafe deserialization, or authorization-bypass flaws historically seen in this product line. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers all editions of the affected supported versions.

RemediationAI

Apply the patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish backported fixes outside the CPU cycle, so out-of-band patching is not an option. Until the CPU can be staged, compensating controls include restricting network access to the Content Server HTTP/HTTPS listener (default 16200/16201) to trusted management VLANs and reverse proxies, disabling self-service account provisioning to prevent low-privilege account creation, auditing and pruning unused WebCenter Content user accounts especially those with any role beyond anonymous, and placing the Content Server behind a WAF with rules to flag anomalous POST traffic to /cs/idcplg endpoints - note that aggressive filtering may break check-in and workflow integrations, so test in non-production first. Increase logging on Content Server intradoc audit logs to detect anomalous service requests pending patch deployment.