CVE-2026-35286 is a critical security vulnerability affecting Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the product, leading to full takeover. The vulnerability is rated with a CVSS 3.1 score of 9.8, reflecting high severity with impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this and numerous other vulnerabilities, recommending immediate application of patches. While the advisory does not specify a distinct patch version for this CVE, it strongly advises customers to apply the Critical Security Patch Update without delay. Interim mitigations include blocking network protocols necessary for exploitation and limiting user privileges to reduce attack surface. No exploits have been publicly reported yet.

Successful exploitation of CVE-2026-35286 can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can take over the product, potentially gaining full control over content and related services.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users to limit access to vulnerable components. Oracle does not provide a specific patch version in the advisory but emphasizes prompt patching as the primary mitigation. Monitor Oracle's official advisory for updates on patch availability and installation instructions.