CVE-2026-35280 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability. The vulnerability's high CVSS score and potential for significant impact on additional products make it a critical concern for enterprises relying on these versions.

Technical summary

The vulnerability is located in the Client Bundle component of Oracle WebCenter Enterprise Capture. It allows an attacker with low privileges and network access to compromise the product. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a high severity level. The vulnerability can lead to a complete takeover of the affected product. Successful attacks may significantly impact additional products due to the scope change. Organizations should review their deployments and assess potential impact on connected systems. The CVE record and NVD entry provide critical details for understanding the vulnerability's impact and required mitigations.

Defensive priority

High

Recommended defensive actions

• Apply the security patch provided by Oracle Corporation as soon as possible.
• Implement compensating controls to monitor and restrict network access to Oracle WebCenter Enterprise Capture.
• Conduct an inventory check to identify all instances of Oracle WebCenter Enterprise Capture within the organization.
• Consider temporary mitigations, such as restricting access to the affected component or disabling T3, IIOP protocols if not required.
• Review system logs for indicators of compromise.
• Monitor network traffic for unusual activity.
• Perform a thorough risk assessment to identify potential targets.

Evidence notes

The CVE record was published on 2026-06-17T10:40:20.293Z and was last modified on 2026-06-23T13:55:31.493Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the official CVE record and NVD database.

Official resources