CVE-2026-35316 is a critical vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise the system, resulting in full takeover of Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 9.9, indicating high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among others and strongly recommends applying patches promptly. Until patches are applied, risk can be mitigated by blocking attack-required network protocols and limiting user privileges. No explicit fixed versions are stated in the advisory, and no exploits in the wild are currently known.

Successful exploitation of CVE-2026-35316 allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Content, leading to complete takeover of the product. This includes full loss of confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products integrated or dependent on WebCenter Content may also be significantly impacted. The vulnerability is rated critical with a CVSS 3.1 base score of 9.9.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. The advisory does not specify fixed versions but indicates that patches are available in this update. Until patches can be applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to packages from users who do not require them. Oracle advises caution as these mitigations may impact application functionality. Customers should refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.