External risk intelligence

Oracle WebCenter Content Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-35319

Oracle WebCenter Content is a content management system commonly deployed as a web application accessible over HTTP. As a server-side enterprise middleware product, it is frequently exposed to network or internet traffic to facilitate user and system access to content services.

Oracle Webcenter Content

12.2.1.4.014.1.2.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Content, a product within Oracle Fusion Middleware. This issue, easily exploitable by an unauthenticated attacker over the network, could lead to a complete takeover of the affected system. The high severity score indicates significant potential impacts on confidentiality, integrity, and availability.

Unauthenticated access can fully compromise the content system.
Leadership should remember this for its critical system takeover potential.
Confirm relevance and assess exposure of Oracle WebCenter Content.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a malicious request over the network to an affected Oracle WebCenter Content server. This access requires no prior authentication and targets the Content Server component. Successful exploitation allows the attacker to gain complete control of the WebCenter Content system.

Unauthenticated network access required.
Content Server component is triggered.
Complete system takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the Oracle WebCenter Content system, potentially allowing an attacker to gain complete control. This could affect the confidentiality, integrity, and availability of the content management system when accessed over a network.

Content management system data at risk.
Unauthenticated network access can exploit.
Takeover of the content management system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Oracle WebCenter Content, accessible via HTTP, is likely to be owned by the application or platform team responsible for its deployment and maintenance. The first crucial step is to locate all instances of this product, assess their exposure and criticality, and identify the accountable owner before planning remediation.

Application or platform teams should own the issue.
Verify instance reachability and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Content?

Oracle WebCenter Content is a component of Oracle Fusion Middleware designed to manage enterprise documents, digital assets, and web content. It acts as a centralized repository that organizations use to store, organize, and serve business-critical files and information to users and other enterprise applications over a network.

What does CVE-2026-35319 mean for system security?

This vulnerability is classified as CWE-284, which refers to improper access control. In this specific case, the weakness allows an unauthenticated user to bypass security checks and gain full control over the Content Server component, effectively enabling a complete system takeover.

How can an attacker trigger this vulnerability?

An attacker triggers this issue by sending a specially crafted request over the network using HTTP. The attack does not require any prior authentication or special user permissions to succeed. Simply navigating to the application via standard web protocols is sufficient to reach the vulnerable component.

Is my instance of Oracle WebCenter Content at risk?

According to Halo Surface Signal, this software is frequently deployed as a web application accessible over HTTP, making it common for such systems to be exposed to network or internet traffic. If your instance is reachable over a network, it is a potential target for this vulnerability.

What should I do first to address this?

Start by identifying all deployed instances of Oracle WebCenter Content within your environment. Once you have a complete inventory, work with the platform or application teams to determine which instances are accessible over the network and prioritize those for security updates.

References

www.oracle.com/security-alerts/cspujun2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.