CVE-2026-35319 affects Oracle WebCenter Content (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the system, potentially leading to full takeover. The vulnerability is scored 9.8 on the CVSS 3.1 scale, reflecting critical impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. However, the advisory does not explicitly confirm patch availability or an official fix specifically for these versions of Oracle WebCenter Content. Oracle strongly urges customers to apply the Critical Security Patch Update without delay and to remain on actively supported versions. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via HTTP can exploit this flaw, making it highly critical. There are no known exploits in the wild reported at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. The vendor advisory does not explicitly confirm patch availability for the affected versions but advises applying the CSPU promptly. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users; however, these measures may disrupt normal application functionality. Customers should monitor Oracle's advisory for updates on patch availability and remediation guidance.