CVE-2026-35322 is a vulnerability in Oracle WebCenter Content (Oracle Fusion Middleware component Content Server) affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to full product takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which addresses 245 security issues across multiple products. Oracle strongly urges customers to apply the update without delay. The advisory does not explicitly state that a patch for this specific vulnerability is available yet, but the Critical Security Patch Update is the intended remediation.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Content, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and by removing unnecessary privileges or access to sensitive packages from users. These mitigations may disrupt application functionality. Patch status is not explicitly confirmed for these versions in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.