CVE-2026-35326 affects Oracle WebCenter Content (component: Content Server) in versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a high privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability (7.2 base score). Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly recommends applying the patches promptly. No explicit patch version or temporary workaround is detailed in the advisory, but reducing network exposure and limiting privileges may reduce risk until patches are applied.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access via HTTP to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not require them. These mitigations may impact application functionality, so they should be tested carefully. Patch status is not explicitly confirmed for this specific CVE in the advisory, but the vendor advisory is authoritative and indicates that the Critical Security Patch Update addresses this vulnerability.