What is the CVSS score of CVE-2026-35327?

CVE-2026-35327 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Content are affected by CVE-2026-35327?

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 contain a cross-tenant data exposure vulnerability (CVSS 7.6) enabling authenticated attackers to access confidential information beyond…

How to fix or mitigate CVE-2026-35327?

Within 24 hours: Inventory all Oracle WebCenter Content deployments and identify affected versions (12.2.1.4.0 and 14.1.2.0.0); restrict Content Server HTTPS access to necessary personnel only. Within 7 days: Enable detailed logging for cross-tenant access patterns; contact Oracle Support to confirm patch timeline and environmental scope. Within 30 days: Apply vendor patch immediately upon release; perform forensic log analysis for unauthorized cross-tenant access.

Oracle WebCenter Content CVE-2026-35327

EUVD-2026-37453 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Content Oracle Corporation

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Reachable over HTTPS with low-privileged credentials and victim interaction; scope change reflects pivot beyond Content Server, with high confidentiality, limited integrity, and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Cross-tenant data exposure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged authenticated attacker to compromise the Content Server component via HTTPS when a victim is tricked into interacting with attacker-supplied content. The flaw produces a scope change, meaning successful exploitation can reach beyond WebCenter Content itself, yielding high confidentiality loss and limited integrity modifications. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Content Server within Oracle Fusion Middleware's WebCenter Content, an enterprise content management platform used for document, records, and digital asset management. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) is consistent with a web-tier flaw such as a stored cross-site scripting, request forgery, or content-injection issue that executes in another user's authenticated session and reaches across trust boundaries - explaining both the UI:R requirement and the scope change. No CWE was assigned in the input, but the tag 'Authentication Bypass' combined with UI:R suggests session-context abuse rather than a pure auth-bypass primitive; the description language ('attacks may significantly impact additional products') aligns with a browser- or token-mediated pivot from the Content Server to integrated Fusion Middleware services.

RemediationAI

Apply the patches bundled in Oracle's Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html, which is the only vendor-released fix path for the affected 12.2.1.4.0 and 14.1.2.0.0 releases; Oracle does not publish standalone hotfixes outside the CPU cycle. Until the CPU can be installed, restrict access to the Content Server web tier to trusted internal networks via network ACLs or a reverse-proxy allowlist (which will break external partner portals if used), enforce strict session and SameSite cookie policies and a tight Content-Security-Policy at the proxy to blunt UI-mediated cross-context attacks, and disable or constrain anonymous and self-registration roles so that PR:L attackers cannot easily obtain a foothold. Note that hardening the proxy does not address the scope-changed impact on downstream Fusion Middleware integrations, so prioritize the CPU.