What is the CVSS score of CVE-2026-35322?

CVE-2026-35322 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35322?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain an account takeover vulnerability (CVSS 8.8) that allows low-privileged authenticated users to achieve complete compromise of the…

How to fix or mitigate CVE-2026-35322?

Within 24 hours: Inventory all Oracle WebCenter Content deployments and identify which systems run versions 12.2.1.4.0 or 14.1.2.0.0. Within 7 days: Restrict HTTP access to affected systems to trusted networks only via firewall rules, enforce multi-factor authentication for all user accounts, and enable comprehensive audit logging of all authentication and administrative actions. Within 30 days: Confirm patch availability timeline directly with Oracle; if patching cannot occur within 90 days, implement persistent technical controls or evaluate alternative content management platforms.

Oracle WebCenter Content CVE-2026-35322

EUVD-2026-37448 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and any authenticated WebCenter account (PR:L); Oracle states full takeover, giving C:H/I:H/A:H within the Content Server's scope (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:16 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker to fully compromise the Content Server over HTTP. Oracle's June 2026 Critical Patch Update rates this 8.8 with complete confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Content (formerly Stellent/UCM) is the enterprise content and records management platform within Oracle Fusion Middleware, used for document storage, imaging, digital asset management, and records retention. The vulnerable Content Server component is the core HTTP-facing service that handles document ingestion, metadata, search, and the IdcCommand/RIDC interfaces. Oracle's advisory does not assign a CWE, but the combination of low privilege required, network HTTP vector, low complexity, and full CIA impact is characteristic of an authenticated request-handling flaw - historically WebCenter Content has been affected by deserialization, path traversal, and command-injection classes in this same component.

RemediationAI

Apply the Patch available per vendor advisory by installing the June 2026 Critical Patch Update for Oracle Fusion Middleware (https://www.oracle.com/security-alerts/cspujun2026.html) to both 12.2.1.4.0 and 14.1.2.0.0 deployments - Oracle does not publish granular patched build numbers in the public CPU page, so reference the My Oracle Support patch IDs listed in the CPU matrix for your exact release. Until the CPU is staged, reduce exposure by placing Content Server behind a reverse proxy or WAF that restricts the /cs/ IdcCommand and management endpoints to administrative networks only (side effect: breaks remote RIDC/IPM integrations until allowlisted), aggressively reviewing and trimming low-privilege account membership (trade-off: may disrupt self-service users), and enabling enhanced HTTP request logging on the Content Server to detect anomalous IdcService calls. Do not rely on perimeter controls alone if any business user accounts are valid on the system, since PR:L is satisfied by ordinary contributor-level credentials.