Oracle WebCenter Content CVE-2026-35325

Attacker must possess valid low-privileged credentials (PR:L) on the target Oracle WebCenter Content instance and network reachability to the Content Server HTTP interface - typical for any internal user, contractor, or partner with a standard WebCenter login. No user interaction is required (UI:N) and no non-default configuration is mentioned by Oracle, so default deployments of versions 12.2.1.4.0 and 14.1.2.0.0 are exploitable. Limiting factors: the Content Server HTTP endpoint must be reachable from the attacker's network position, and the attacker needs at least one valid authenticated session - fully unauthenticated internet-facing exploitation is not supported by the CVSS vector.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, with full impact on confidentiality, integrity, and availability - Oracle explicitly describes this as 'easily exploitable' resulting in 'takeover.' EPSS data was not provided in the input, and the CVE is not listed in CISA KEV, so widespread or targeted exploitation cannot be confirmed at this time. No public POC was identified, which lowers immediate weaponization risk, but Oracle CPU vulnerabilities historically attract reverse-engineering once patches ship, so the gap between disclosure and exploit publication can be short. Because Oracle WebCenter Content is often deployed in enterprise document/records management contexts holding sensitive data, even authenticated takeover is a meaningful priority despite the PR:L requirement.

An attacker who has obtained or registered any low-privileged WebCenter Content account (for example, a standard end-user document contributor) sends crafted HTTP requests to the Content Server endpoint over the network. The request abuses the unspecified flaw in the Content Server component to escalate privileges or execute privileged actions, resulting in full takeover of the WebCenter Content instance - including read/modify access to all stored documents and configuration. No public POC has been identified at time of analysis, but the low attack complexity makes development straightforward once the patch is diffed.