CVE-2026-35283 is a critical vulnerability affecting Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) within Oracle Fusion Middleware. The flaw allows a low privileged attacker with network access via T3 and IIOP protocols to compromise the product, potentially resulting in complete takeover. The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. The CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high severity across confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 patches across multiple products. The vendor strongly recommends applying these patches immediately. Mitigations include blocking attack-related network protocols and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of CVE-2026-35283 can lead to full compromise of Oracle WebCenter Enterprise Capture, including complete takeover of the system. The vulnerability affects confidentiality, integrity, and availability, potentially allowing attackers to access sensitive data, modify or disrupt operations, and impact additional Oracle products due to scope change. The CVSS score of 9.9 indicates critical impact.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-35283 among other vulnerabilities. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (T3, IIOP) and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle’s advisory emphasizes prompt patching as the primary remediation.