What is the CVSS score of CVE-2026-35321?

CVE-2026-35321 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-35321?

Within 24 hours: Restrict network access to all WebCenter Content instances to internal/trusted IP ranges only and audit active user accounts with Content Server permissions. Within 7 days: Implement network segmentation isolating WebCenter Content from other Fusion Middleware components, deploy host-based intrusion detection, and enable comprehensive authentication/content-access logging. Within 30 days: Establish vendor patch monitoring protocol for CVE-2026-35321 remediation; coordinate testing and deployment timeline for patched versions (12.2.1.x, 14.1.2.x) across production, staging, and non-critical instances.

Oracle WebCenter Content CVE-2026-35321

EUVD-2026-37447 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged WebCenter credentials
Delivery

Reach Content Server HTTP endpoint
Exploit

Send crafted authenticated request
Execution

Trigger scope-changing flaw
Persist

Take over WebCenter Content instance
Impact

Pivot to adjacent Fusion Middleware components

Vulnerability Assessment

Weakness	CWE CWE-284 MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker must possess valid low-privileged credentials for the Oracle WebCenter Content Content Server (PR:L) and be able to reach its HTTP interface over the network (AV:N); no user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to deployments running supported versions 12.2.1.4.0 or 14.1.2.0.0 of WebCenter Content with the Content Server component exposed to the attacker's network position - typically internal corporate networks, partner extranets, or internet-exposed document portals. There is no indication of a non-default configuration requirement, so default Content Server installations on the affected versions are exploitable once any authenticated account is obtained.
Impact	All available signals converge on high real-world risk: CVSS 3.1 is 9.9 with AV:N/AC:L/PR:L/UI:N/S:C and full High impact on confidentiality, integrity, and availability - the scope change indicates compromise can reach beyond WebCenter Content into other Fusion Middleware components or downstream systems. PR:L means a single low-privileged WebCenter account (which many enterprises grant broadly to internal users or partners) is sufficient. EPSS and CISA KEV data were not supplied in the input, so widespread exploitation probability cannot be quantified, and no public POC is referenced - this likely reflects the recency of Oracle's June 2026 CPU rather than absence of risk. The main uncertainty is the exact root cause, since Oracle CPUs disclose minimal technical detail and no CWE was assigned; defenders should treat this as a near-certain target for reverse-engineering against the patch.
Exploit ScenarioDerived	An attacker who has obtained any low-privileged WebCenter Content user credential - through phishing, credential stuffing against an exposed login portal, or a compromised partner account - authenticates to the Content Server over HTTP and sends a crafted request that exploits the flaw to take over the WebCenter Content instance and pivot into adjacent Fusion Middleware components via the scope change. Because Oracle states the issue is 'easily exploitable', reverse engineering of the June 2026 CPU patch is likely to yield a working exploit shortly after release even though no public exploit identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged remote attacker over HTTP, with scope change enabling impact on adjacent products in the Fusion Middleware stack. The flaw carries a CVSS 3.1 base score of 9.9 and is described by Oracle as easily exploitable, though no public exploit identified at time of analysis. Authenticated access to the Content Server is the only meaningful barrier, making this a high-priority patch item for enterprises using WebCenter Content for document management.

RemediationAI

Apply the patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0, as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle does not publish backported fixes outside the CPU cycle, so out-of-band patching is not an option. Until the CPU can be staged, compensating controls include restricting network access to the Content Server HTTP/HTTPS listener (default 16200/16201) to trusted management VLANs and reverse proxies, disabling self-service account provisioning to prevent low-privilege account creation, auditing and pruning unused WebCenter Content user accounts especially those with any role beyond anonymous, and placing the Content Server behind a WAF with rules to flag anomalous POST traffic to /cs/idcplg endpoints - note that aggressive filtering may break check-in and workflow integrations, so test in non-production first. Increase logging on Content Server intradoc audit logs to detect anomalous service requests pending patch deployment.

Affected VersionsENISA

Oracle WebCenter Content 12.2.1.4.0

Oracle WebCenter Content 14.1.2.0.0

Affected Packages

euvd oracle_webcenter_content no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebCenter Content (formerly Oracle UCM/Stellent) is an enterprise content management platform built on top of WebLogic Server, providing document management, records management, and digital asset management capabilities. The vulnerable Content Server component handles HTTP-based interactions for check-in, retrieval, and workflow operations, and is typically integrated with broader Oracle Fusion Middleware deployments. CWE is not assigned by Oracle, but the combination of low-privileged HTTP exploitation, scope change, and full CIA impact is characteristic of authenticated injection, unsafe deserialization, or authorization-bypass flaws historically seen in this product line. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers all editions of the affected supported versions.

Know when Oracle Webcenter Content gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 9.9 CRITICAL

HTTP-reachable Content Server (AV:N), easily exploitable per Oracle (AC:L), requires a low-privileged account (PR:L), no user interaction, and full takeover with cross-product impact justifies S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 face critical risk from a remotely exploitable vulnerability (CVSS 9.9) allowing low-privilege authenticated users to achieve complete system takeover with scope change affecting adjacent Fusion Middleware systems. No vendor patch is currently available, leaving organizations relying on WebCenter Content for document management immediately exposed to data breach, manipulation, and lateral infrastructure compromise. Immediate defensive measures are required to mitigate active business risk.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigation: Enforce strict network segmentation and IP whitelisting for WebCenter Content access, disable unnecessary service endpoints, implement real-time audit logging for all authentication attempts and content operations, require multi-factor authentication for administrative access, and consider temporary operational suspension of non-critical WebCenter Content instances until patched versions are available from Oracle.

Threat Intelligence Overview

EPSS Score

0.5%

Top 62% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.