PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35280 Oracle Corporation CVE debrief

A critical vulnerability was discovered in Oracle WebCenter Enterprise Capture, a product of Oracle Fusion Middleware. The vulnerability, tracked as CVE-2026-35280, has a CVSS 3.1 Base Score of 9.9, indicating a high severity level. It affects versions 12.2.1.4.0 and 14.1.2.0.0 of the product. The vulnerability is easily exploitable by a low-privileged attacker with network access via T3, IIOP, potentially leading to a takeover of Oracle WebCenter Enterprise Capture. The scope of the vulnerability is not limited to the product itself, as successful attacks may significantly impact additional products.

Vendor
Oracle Corporation
Product
Oracle WebCenter Enterprise Capture
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-23
Advisory published
2026-06-17
Advisory updated
2026-06-23

Who should care

Organizations using Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability. The vulnerability's high CVSS score and potential for significant impact on additional products make it a critical concern for enterprises relying on these versions.

Technical summary

The vulnerability is located in the Client Bundle component of Oracle WebCenter Enterprise Capture. It allows an attacker with low privileges and network access to compromise the product. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a high severity level. The vulnerability can lead to a complete takeover of the affected product. Successful attacks may significantly impact additional products due to the scope change. Organizations should review their deployments and assess potential impact on connected systems. The CVE record and NVD entry provide critical details for understanding the vulnerability's impact and required mitigations.

Defensive priority

High

Recommended defensive actions

  • Apply the security patch provided by Oracle Corporation as soon as possible.
  • Implement compensating controls to monitor and restrict network access to Oracle WebCenter Enterprise Capture.
  • Conduct an inventory check to identify all instances of Oracle WebCenter Enterprise Capture within the organization.
  • Consider temporary mitigations, such as restricting access to the affected component or disabling T3, IIOP protocols if not required.
  • Review system logs for indicators of compromise.
  • Monitor network traffic for unusual activity.
  • Perform a thorough risk assessment to identify potential targets.

Evidence notes

The CVE record was published on 2026-06-17T10:40:20.293Z and was last modified on 2026-06-23T13:55:31.493Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the official CVE record and NVD database.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35280 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35280

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35280 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35280

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.