CVE-2026-35320: Critical severity Oracle Oracle WebCenter Content vulnerability
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Oracle WebCenter Content HTTP interfaces: block or deny HTTP access from untrusted networks (including the public Internet) using network firewalls, WAF, or ACLs; allow only trusted management IPs/networks to reach the service.
- Compensating control
Segment and isolate Oracle WebCenter Content from other applications and sensitive infrastructure to limit scope and lateral movement (place the servers in a restricted network zone/VLAN and apply strict ingress/egress rules).
- Operational
Assume potential compromise if the service was exposed; monitor logs and indicators of compromise for signs of takeover, perform incident response as needed, and rotate any credentials, keys, or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35320?
CVE-2026-35320 has a severity rating of critical (9).
How do I fix CVE-2026-35320?
To fix CVE-2026-35320, update to a patched version of Oracle WebCenter Content that addresses this vulnerability.
What products are affected by CVE-2026-35320?
CVE-2026-35320 affects Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0.
Can an attacker exploit CVE-2026-35320 remotely?
Yes, an unauthenticated attacker with network access via HTTP can exploit CVE-2026-35320.
What is the impact of exploiting CVE-2026-35320?
Exploiting CVE-2026-35320 can lead to a complete compromise of the Oracle WebCenter Content server.