What is the CVSS score of CVE-2026-35323?

CVE-2026-35323 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35323?

Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical vulnerability enabling unauthorized system takeover through low-privilege HTTP requests, with cascading risk to…

How to fix or mitigate CVE-2026-35323?

Within 24 hours: Inventory all Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 instances in your environment; restrict HTTP access to the Content Server component to essential users only and disable external access where possible. Within 7 days: Implement enhanced monitoring and logging of all Content Server HTTP traffic; review access logs for signs of exploitation. Within 30 days: Contact Oracle for patch timeline; if no patch emerges within 60 days, evaluate alternative document management platforms or implement long-term compensating controls.

Oracle WebCenter Content CVE-2026-35323

EUVD-2026-37449 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Oracle describes easily exploitable HTTP access by a low-privileged user with no interaction, scope change to other Fusion Middleware products, and full takeover impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker sending HTTP requests to the Content Server component, with a scope change that can significantly impact additional products. Oracle rates this 9.9 CVSS and describes it as easily exploitable, and no public exploit identified at time of analysis. Reported in the Oracle Critical Patch Update for June 2026, the flaw enables full compromise of the WebCenter Content instance and any in-scope downstream systems.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management (ECM) platform in Oracle Fusion Middleware, providing document management, records management, digital asset management and imaging through the Content Server component, which exposes an HTTP-based interface used by web clients and integrations with other Fusion Middleware products such as WebCenter Portal, E-Business Suite and PeopleSoft. The affected versions are the 12c release (12.2.1.4.0) and the 14c release (14.1.2.0.0), corresponding to CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*. No CWE is assigned by Oracle, but the combination of low-privileged HTTP-driven exploitation, scope change and full CIA impact is consistent with an authenticated server-side flaw in Content Server request handling (for example deserialization, server-side template/expression injection, or an authorization-bypass-to-RCE chain) that leverages WebCenter's integration trust into adjacent components.

RemediationAI

Patch available per vendor advisory: apply the Oracle Critical Patch Update for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 using the WebCenter Content patch set identified in the CPU matrix, following Oracle's documented Fusion Middleware patching procedure and restarting the Content Server managed servers. Until the CPU bundle can be applied, restrict network reachability of the Content Server HTTP/HTTPS endpoints to trusted management networks via firewall or reverse-proxy ACLs (accepting that this will break external portal and integration access), tighten the WebCenter Content role model so that only essential accounts retain authenticated access (reducing the pool of 'low privileged' principals who can trigger the flaw at the cost of operational friction for end users), and increase WebLogic and Content Server audit logging on authenticated HTTP requests to detect anomalous activity; do not rely on WAF-only mitigations as a substitute for the CPU patch given the scope-change impact on adjacent Fusion Middleware products.