CVE-2026-35315 affects Oracle WebCenter Content (Oracle Fusion Middleware component Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP and can result in complete compromise of Oracle WebCenter Content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (8.8 base score). Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others, urging customers to apply patches without delay. Mitigation options prior to patching include blocking network protocols used by the attack and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product instance.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update patches as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users. These mitigations may affect application functionality. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions. Patch status is not explicitly confirmed in the input data; therefore, check the vendor advisory for current remediation guidance.