Oracle WebCenter Content CVE-2026-35324

Attacker must hold a valid low-privileged account on the target Oracle WebCenter Content instance (PR:L) and must be able to reach the Content Server HTTP interface over the network (AV:N) - no user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to the two enumerated Fusion Middleware releases - Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 - and requires the Content Server component to be deployed and HTTP-accessible from the attacker's position; deployments that isolate Content Server behind admin-only VPN segments or that have already applied the June 2026 CPU are not exploitable via this path.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H plus Oracle's own 'easily exploitable' wording and 'takeover' impact statement make this a high-priority patch item for any organization running WebCenter Content, particularly where the Content Server is reachable from internal user networks or, worse, exposed to the internet. EPSS and SSVC data were not provided, so probabilistic exploitation likelihood cannot be cited; absence of KEV and POC data lowers the immediate urgency relative to actively exploited Fusion Middleware bugs, but Oracle Content Server has a recurring history of attacker interest in Critical Patch Updates, so weaponization within weeks of disclosure is plausible. Key caveat: PR:L means any valid low-privileged account (which in many WebCenter deployments includes broad internal user populations and federated SSO identities) is sufficient - a lower bar than it appears in pure CVSS terms.

An attacker who has obtained any low-privileged WebCenter Content account - for example through a phished employee credential, a stale contractor login, or a compromised federated SSO identity - sends crafted HTTP requests to the Content Server endpoint and abuses the flaw to escalate to full administrative control of the content repository, then exfiltrates sensitive documents, plants malicious content, or disrupts the service. No public exploit identified at time of analysis, so the scenario currently requires the attacker to develop their own technique against the patched/unpatched diff.