CVE-2026-35322 affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in complete takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes patches addressing this and other vulnerabilities. The advisory strongly recommends applying patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges from users, though these may disrupt normal operations.

Successful exploitation of CVE-2026-35322 can lead to full compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This means attackers could gain unauthorized access, modify or delete data, and disrupt service availability. The vulnerability is exploitable remotely over HTTP by a low privileged attacker, increasing the risk of widespread impact if unpatched.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches as soon as possible to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Patch status is confirmed by the vendor advisory; therefore, applying the official patches is the recommended remediation.