CVE-2026-35316 is a critical vulnerability in the Oracle WebCenter Content product (component: Content Server) of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP, enabling compromise and potential takeover of Oracle WebCenter Content. The vulnerability also impacts additional Oracle products beyond WebCenter Content (scope change). The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impacts on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 patches. Oracle strongly recommends applying these patches promptly to mitigate the risk. Until patches are applied, risk reduction may be achieved by blocking network protocols required for exploitation and removing unnecessary privileges from users.

Successful exploitation of CVE-2026-35316 can lead to complete compromise and takeover of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond WebCenter Content. The CVSS score of 9.9 reflects critical severity with network-based attack, low complexity, and no user interaction required. This can result in unauthorized access, data breaches, and disruption of services.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing CVE-2026-35316. Customers should apply these security patches as soon as possible to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality, so they should be applied carefully. Patch status is not explicitly confirmed in the advisory content provided; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.