CVE-2026-35317 affects Oracle WebCenter Content, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which addresses 245 security issues across multiple Oracle products. Oracle strongly recommends applying the CSPU patches immediately to remediate this vulnerability. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges from users, but these may disrupt normal operations.

The vulnerability permits a low privileged attacker with network access via HTTP to fully compromise Oracle WebCenter Content, resulting in complete takeover. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, and service disruption.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users. However, these mitigations may affect application functionality. Oracle strongly advises staying on actively supported versions and promptly applying security patches. Patch status is confirmed by the vendor advisory linked.