What is the CVSS score of CVE-2026-35324?

CVE-2026-35324 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35324?

A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged users to gain complete control of the system and access all stored content without…

How to fix or mitigate CVE-2026-35324?

24 hours: Identify all systems running Oracle WebCenter Content 12.2.1.4.0 or 14.1.2.0.0 and their business criticality. 7 days: Restrict HTTP network access to affected systems via firewall rules, implement multi-factor authentication for all users, and enable detailed logging of all authentication events. 30 days: Execute upgrade to a patched Oracle WebCenter Content version (consult Oracle for the minimum supported version containing a fix), or decommission the systems if replacement solutions exist.

Oracle WebCenter Content CVE-2026-35324

EUVD-2026-37450 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Oracle states easily exploitable over HTTP by a low-privileged attacker resulting in product takeover, justifying AV:N, AC:L, PR:L, UI:N, and C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Content Server component) allows a low-privileged authenticated attacker with HTTP network access to fully compromise the product, impacting confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Content is the enterprise content management platform within Oracle Fusion Middleware, and the affected Content Server component is the core repository service that handles document ingestion, metadata, check-in/check-out, and HTTP-exposed administrative and user interfaces. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content:*:*:*:*:*:*:*:* combined with the EUVD listing pins the vulnerable code to the 12.2.1.4.0 (12c) and 14.1.2.0.0 (14c) release trains. No CWE is assigned by Oracle, but the combination of HTTP attack vector, low-privilege requirement, and full CIA impact is characteristic of authenticated authorization-bypass or injection-style flaws (e.g., access-control or deserialization weaknesses) commonly seen in prior Content Server CPU bulletins.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0; no exact post-patch build identifier was provided in the input, so cross-reference the CPU patch matrix to obtain the exact bundle for your release train. Until the CPU is applied, restrict network reachability of the Content Server HTTP endpoints to trusted administrator and application subnets via firewall or reverse-proxy ACLs (trade-off: blocks legitimate remote user access), tighten low-privileged account provisioning and disable any unused self-service or guest accounts that satisfy the PR:L prerequisite (trade-off: may disrupt federated or partner workflows), and increase monitoring on Content Server access and audit logs for unusual privilege escalation or administrative actions originating from non-admin accounts.