CVE-2026-35323 is a critical security vulnerability in the Oracle WebCenter Content product (component: Content Server) of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP and can result in complete compromise and takeover of Oracle WebCenter Content. The vulnerability also has a scope change, potentially impacting additional Oracle products. The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability or remediation level for this specific CVE in the advisory content provided. Oracle strongly recommends applying the June 2026 Critical Security Patch Update to address this and other vulnerabilities. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may impact application functionality.

Successful exploitation of CVE-2026-35323 can lead to full compromise and takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Content. This represents a critical risk to affected environments, especially since the attack requires only low privileges and network access via HTTP.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be mitigated by blocking network protocols required by the attack and by removing unnecessary privileges or access to packages from users who do not need them. Note that these mitigations may disrupt application functionality. Patch status is not explicitly confirmed in the advisory content for this specific CVE; therefore, customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.