CVE-2026-35286: Critical severity Oracle Oracle WebCenter Content vulnerability
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle WebCenter Content HTTP service: block or allow only trusted management IPs via firewall/ACLs or network segmentation to prevent unauthenticated HTTP access from untrusted networks.
- Compensating control
Deploy a Web Application Firewall (WAF) or HTTP reverse proxy in front of Oracle WebCenter Content to inspect and block malicious HTTP requests (virtual patching) until an official vendor patch or remediation is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35286?
CVE-2026-35286 has a critical severity rating of 9.8.
Which versions are affected by CVE-2026-35286?
The affected versions for CVE-2026-35286 are 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Content.
How can CVE-2026-35286 be exploited?
CVE-2026-35286 can be exploited by unauthenticated attackers with network access via HTTP.
What impacts does CVE-2026-35286 have on systems?
CVE-2026-35286 can lead to full compromise of Oracle WebCenter Content, affecting confidentiality, integrity, and availability.
How do I mitigate CVE-2026-35286?
To mitigate CVE-2026-35286, you should apply the latest security patches provided by Oracle for the affected versions.