What is the CVSS score of CVE-2026-35326?

CVE-2026-35326 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35326?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVE-2026-35326, CVSS 7.2) enabling complete system takeover of content repositories when accessed via…

How to fix or mitigate CVE-2026-35326?

Within 24 hours: Audit all Oracle WebCenter Content deployments; disable HTTP access and enforce HTTPS-only communication for all affected systems. Within 7 days: Identify and document all high-privileged accounts in Content Server; implement principle of least privilege to reduce the high-privilege user base; enable detailed audit logging of administrative activities. Within 30 days: Monitor Oracle Critical Patch Update releases for CVE-2026-35326 fix; evaluate upgrade feasibility to patched versions or prepare migration strategy if patch availability extends beyond risk tolerance.

Oracle WebCenter Content CVE-2026-35326

EUVD-2026-37452 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable Content Server function requiring an existing high-privileged account (PR:H), trivially scriptable once authenticated (AC:L, UI:N), yielding full system takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible when a high-privileged attacker reaches the Content Server over HTTP, per Oracle's June 2026 Critical Patch Update. The flaw yields complete confidentiality, integrity, and availability compromise (CVSS 7.2) but requires existing elevated privileges, and no public exploit identified at time of analysis. Exploitation is rated easy once the privilege bar is met, making this a priority for environments where many users hold administrative roles in Content Server.

Technical ContextAI

Oracle WebCenter Content (formerly Stellent/UCM) is an enterprise content management platform in the Oracle Fusion Middleware stack, and the affected Content Server component is the core service that handles document ingestion, metadata, and HTTP-exposed administrative and user APIs. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_content covers both shipping branches (12.2.1.4.0 and 14.1.2.0.0). Oracle did not publish a CWE for this entry, but the combination of HTTP attack vector, PR:H privilege requirement, and 'takeover' impact is consistent with an authenticated administrative function performing an unsafe operation (e.g., insecure deserialization, configuration abuse, or privileged file/handler manipulation) within the Content Server tier.

RemediationAI

Apply the fixes bundled in the Oracle June 2026 Critical Patch Update (cpujun2026) for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 per https://www.oracle.com/security-alerts/cspujun2026.html; patch available per vendor advisory, with no separately published standalone fix version called out beyond the CPU. Until the CPU is deployed, tightly restrict the population of accounts holding admin/high-privilege roles in Content Server, audit recent privileged role grants, place the Content Server administrative HTTP interfaces behind VPN or IP allow-listing, and enable verbose audit logging on the Content Server so that abuse of high-privilege operations is detectable; the trade-off is reduced administrator convenience and potential disruption to integrations that rely on broad service-account privileges. Avoid disabling Content Server outright as a compensating control unless the environment can tolerate the content management outage.