---METADATA---
VENDOR: goshs
PRODUCT: goshs
AFFECTED_VERSIONS: Prior to 2.0.0-beta.3
---END_METADATA---

Description Summary:
The goshs SimpleHTTPServer fails to sanitize directories during multipart POST uploads, enabling unauthorized file placement.

Executive Summary:
An arbitrary file write vulnerability in goshs allows remote attackers to place files in unauthorized locations, potentially leading to system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35393

Affected Software: goshs

Affected Versions: Prior to 2.0.0-beta.3

Vulnerability: The application fails to sanitize the target directory for multipart POST uploads. This allows an attacker to manipulate the upload destination via malicious input.

Business Impact

This vulnerability enables unauthorized file uploads, which can be used to place malicious scripts or overwrite system files. With a CVSS score of 9.8, this poses a high risk of complete server takeover.

Remediation Plan

Immediate Action: Update goshs to version 2.0.0-beta.3 or later.

Proactive Monitoring: Review access logs for suspicious POST requests and verify the integrity of uploaded files.

Compensating Controls: Implement strict filesystem permissions and ensure the service runs in a restricted chroot or containerized environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to prevent unauthorized file placement. Upgrade to the latest version to ensure that input sanitization is correctly implemented for all file upload methods.

---METADATA---
VENDOR: goshs
PRODUCT: goshs
AFFECTED_VERSIONS: Prior to 2.0.0-beta.3
---END_METADATA---

Description Summary:
The goshs SimpleHTTPServer fails to sanitize file paths during PUT uploads, enabling arbitrary file write/overwrite.

Executive Summary:
An arbitrary file write vulnerability in goshs allows remote attackers to upload or overwrite files on the host system, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35392

Affected Software: goshs

Affected Versions: Prior to 2.0.0-beta.3

Vulnerability: The PUT upload functionality in httpserver/updown.go lacks path sanitization. An attacker can supply malicious paths to write files outside the intended directory.

Business Impact

This vulnerability allows attackers to overwrite critical configuration files or upload web shells, leading to arbitrary code execution. With a CVSS score of 9.8, this constitutes a severe risk to the availability and integrity of the hosting server.

Remediation Plan

Immediate Action: Update goshs to version 2.0.0-beta.3 or later.

Proactive Monitoring: Monitor web server logs for suspicious PUT requests containing directory traversal sequences (e.g., ../).

Compensating Controls: Run the service with the least privilege possible and use filesystem-level restrictions to prevent unauthorized writes to sensitive directories.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The lack of path sanitization is a critical oversight. Administrators must upgrade to the latest beta version immediately and ensure that the service is isolated from sensitive system paths.

---METADATA---
VENDOR: Google
PRODUCT: Chrome
AFFECTED_VERSIONS: Google Chrome versions prior to 145
---END_METADATA---

Description Summary:
Google Chrome versions prior to 145 are vulnerable to an object lifecycle flaw within the DevTools component, potentially leading to memory corruption or arbitrary code execution.

Executive Summary:
A high-severity object lifecycle issue in Google Chrome's DevTools could allow an attacker to compromise the browser environment, leading to potential data theft or system instability.

Vulnerability Details

CVE-ID: CVE-2026-3539

Affected Software: Google Chrome

Affected Versions: Versions prior to 145

Vulnerability: This vulnerability involves an "object lifecycle" issue within the DevTools engine. Such flaws typically occur when the browser incorrectly manages the memory or state of an object, which can be exploited to achieve use-after-free conditions or other memory corruption states.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant risk to endpoint security. Exploitation could lead to the compromise of the user's browser session, theft of sensitive information (such as session cookies or credentials), or the execution of malicious code. Given Chrome's ubiquity, this poses a widespread risk to corporate data and user privacy.

Remediation Plan

Immediate Action: Update Google Chrome to version 145 or later across all enterprise workstations immediately.

Proactive Monitoring: Utilize endpoint detection and response (EDR) tools to monitor for unusual browser behavior or crashes that may indicate exploitation attempts.

Compensating Controls: Implement browser isolation technologies or restrict the use of developer tools through Group Policy Objects (GPO) for non-technical staff to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, browser vulnerabilities are frequently targeted by exploit kits and advanced persistent threat (APT) groups.

Analyst Recommendation

The high CVSS score and the critical nature of browser security make this a priority for remediation. IT administrators should use automated patch management systems to ensure all instances of Google Chrome are updated to version 145 or higher without delay.

---METADATA---
VENDOR: OpenSSH
PRODUCT: OpenSSH
AFFECTED_VERSIONS: Versions before 10
---END_METADATA---

Description Summary:
A vulnerability in OpenSSH versions prior to 10 has been identified, which could allow for unauthorized access or information disclosure during SSH sessions.

Executive Summary:
OpenSSH, a critical tool for secure remote access, contains a high-severity vulnerability in versions prior to 10 that could compromise secure remote management.

Vulnerability Details

CVE-ID: CVE-2026-35385

Affected Software: OpenSSH OpenSSH

Affected Versions: Versions before 10

Vulnerability: The flaw exists in the core implementation of OpenSSH. While the specific mechanism is not detailed, such vulnerabilities in SSH often involve memory corruption or logic errors that could be exploited by a remote attacker during the authentication or session establishment phase.

Business Impact

The CVSS score of 7.5 highlights the high risk to organizational security. OpenSSH is a primary gateway for administrative access; a successful exploit could grant an attacker remote shell access or allow them to hijack existing sessions, leading to full system compromise and potential lateral movement.

Remediation Plan

Immediate Action: Upgrade all OpenSSH installations to version 10 or later immediately to resolve this security flaw.

Proactive Monitoring: Review SSH logs for failed login attempts from unusual IP addresses or anomalous session behavior that might indicate exploitation attempts.

Compensating Controls: Limit SSH access to specific authorized IP ranges using firewalls and enforce the use of public-key authentication rather than passwords to reduce the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, OpenSSH vulnerabilities are historically high-priority targets for sophisticated threat actors.

Analyst Recommendation

OpenSSH is fundamental to secure infrastructure management. The urgency of upgrading to version 10 cannot be overstated; administrators must prioritize this update to protect administrative access points from potential compromise.

---METADATA---
VENDOR: Google
PRODUCT: Google Web Fonts GDPR Plugin
AFFECTED_VERSIONS: Up to and including 1.1
---END_METADATA---

Description Summary:
The Google Web Fonts GDPR plugin for WordPress is vulnerable to unauthenticated arbitrary file upload via the DSGVOGWPdownloadGoogleFonts() function, potentially leading to remote code execution.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the Google Web Fonts GDPR plugin for WordPress exposes sites to full system compromise via remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3535

Affected Software: Google Web Fonts GDPR Plugin

Affected Versions: Up to and including 1.1

Vulnerability: This is an arbitrary file upload vulnerability caused by missing file type validation in the DSGVOGWPdownloadGoogleFonts() function. Because the function is exposed via an unauthenticated wp_ajax_nopriv_ hook, an unauthenticated attacker can upload malicious files, such as PHP webshells, to the server.

Business Impact

A successful exploit allows an attacker to achieve remote code execution, granting them full control over the compromised WordPress instance. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete data exfiltration, site defacement, and the deployment of persistent malware, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Google Web Fonts GDPR plugin to the latest available version immediately. If an update is not available, deactivate or remove the plugin until a patch is verified.

Proactive Monitoring: Review web server access logs for suspicious POST requests to the plugin's AJAX endpoints and monitor for newly created files in the upload directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint specifically for this plugin's function if possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—allowing unauthenticated remote code execution—the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical due to the lack of required authentication for exploitation. Administrators must prioritize updating this plugin immediately to prevent potential system takeovers. If immediate patching is not possible, the plugin should be disabled to eliminate the attack vector.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Content Server component of Oracle WebCenter Content, requiring immediate remediation.

Executive Summary:
A critical security flaw in Oracle WebCenter Content could allow unauthorized actors to compromise the integrity of the enterprise content management system.

Vulnerability Details

CVE-ID: CVE-2026-35325

Affected Software: Oracle WebCenter Content

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the Content Server component of Oracle Fusion Middleware. The flaw poses a significant risk to the security posture of the application, requiring immediate investigation and patching by administrators.

Business Impact

The 8.8 CVSS score confirms that this is a high-risk vulnerability with the potential to cause significant business impact, including unauthorized data access or service degradation. Protecting the integrity of the Content Server is essential to maintaining the confidentiality of documents stored within the Oracle ecosystem.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates for Oracle WebCenter Content as soon as they are made available.

Proactive Monitoring: Review audit logs for unauthorized access attempts or suspicious changes to content repository permissions.

Compensating Controls: Ensure that the Content Server is behind a secure proxy or WAF that can detect and mitigate common web-based attack vectors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize the remediation of this high-severity vulnerability to prevent potential exploitation. It is recommended that administrators verify their patch levels and apply updates immediately to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity security vulnerability exists within the Content Server component of Oracle WebCenter Content that may impact system security.

Executive Summary:
This high-severity vulnerability in Oracle WebCenter Content could lead to unauthorized system exposure and impact the integrity of enterprise content.

Vulnerability Details

CVE-ID: CVE-2026-35324

Affected Software: Oracle WebCenter Content

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Content Server component of Oracle Fusion Middleware. The flaw represents a serious security risk that requires urgent attention to prevent potential exploitation of the content management infrastructure.

Business Impact

The CVSS score of 8.8 identifies this as a high-severity issue capable of causing substantial operational disruption or unauthorized data access. Organizations relying on WebCenter Content for document management face risks regarding confidentiality and system availability if this vulnerability is leveraged by an attacker.

Remediation Plan

Immediate Action: Review the latest Oracle security documentation and apply the recommended patches to all affected WebCenter Content instances.

Proactive Monitoring: Monitor system logs for unusual traffic patterns or unauthorized requests directed at the Content Server component.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to filter suspicious requests targeting Oracle middleware interfaces.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must treat this vulnerability as a high priority for remediation. Promptly applying vendor-supplied updates is the most effective way to secure the environment against potential exploitation of this middleware component.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebCenter Content allows a low-privileged attacker to achieve full system takeover via network-based HTTP exploitation.

Executive Summary:
A critical vulnerability in Oracle WebCenter Content permits unauthorized remote takeover of the application by low-privileged attackers, posing a severe risk to organizational data integrity.

Vulnerability Details

CVE-ID: CVE-2026-35323

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability resides in the Content Server component and allows a low-privileged authenticated attacker to compromise the application over the network. The flaw is easily exploitable and does not require complex user interaction.

Business Impact

The CVSS score of 9.9 reflects the extreme severity of this flaw, which allows for complete compromise of the system. Because this vulnerability affects the Content Server, it could result in the unauthorized disclosure or manipulation of critical business documents, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Apply the vendor-recommended updates for Oracle WebCenter Content available at https://www.oracle.com/security-alerts/cspujun2026.html.

Proactive Monitoring: Monitor server logs for unusual administrative activities or unauthorized modifications to content repositories.

Compensating Controls: Utilize a WAF to filter traffic and restrict access to the Content Server to authorized network segments only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a severe risk to the confidentiality and integrity of your business assets. Organizations should prioritize patching these affected versions immediately to prevent potential exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Content Server component of Oracle WebCenter Content that may allow for unauthorized system interaction.

Executive Summary:
This vulnerability in Oracle WebCenter Content poses a significant risk to organizational data integrity and server availability.

Vulnerability Details

CVE-ID: CVE-2026-35322

Affected Software: Oracle WebCenter Content

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a security vulnerability residing in the Content Server component of Oracle Fusion Middleware. Due to the lack of granular technical detail provided by the vendor, the specific authentication requirements remain undefined; however, the high CVSS score suggests a high potential for impact.

Business Impact

With a CVSS score of 8.8, this vulnerability carries a high severity rating, indicating the potential for significant unauthorized access or disruption of business-critical document management systems. Successful exploitation could lead to the exposure of sensitive corporate information or the compromise of administrative functions within the content repository.

Remediation Plan

Immediate Action: Consult the official Oracle Critical Patch Update advisory and apply the necessary security patches immediately.

Proactive Monitoring: Audit server access logs for anomalous behavior and unexpected administrative activity originating from unauthorized or internal accounts.

Compensating Controls: Implement strict network segmentation and ensure the WebCenter Content instance is not exposed to the public internet to limit the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its high severity, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize this update within their standard patching cycle. Failure to remediate could result in unauthorized access to sensitive content repositories, necessitating immediate attention from IT security teams.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebCenter Content allows a low-privileged attacker to achieve full system takeover via network-based HTTP exploitation.

Executive Summary:
A critical vulnerability in Oracle WebCenter Content permits unauthorized remote takeover of the application by low-privileged attackers, posing a severe risk to organizational data integrity.

Vulnerability Details

CVE-ID: CVE-2026-35321

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This is an easily exploitable vulnerability within the Content Server component. It allows a low-privileged authenticated attacker with network access to execute unauthorized actions, potentially leading to a full system compromise.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a critical risk. Successful exploitation allows an attacker to bypass security controls, leading to total compromise of confidentiality, integrity, and availability. Furthermore, the "scope change" indicates that attackers could potentially pivot to impact other interconnected systems within the Oracle Fusion Middleware environment.

Remediation Plan

Immediate Action: Update Oracle WebCenter Content to the latest version provided by the vendor at https://www.oracle.com/security-alerts/cspujun2026.html.

Proactive Monitoring: Review application and network access logs for anomalous HTTP requests originating from low-privileged accounts that deviate from standard operational patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to inspect and block malicious payloads targeting the Content Server component.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for full system takeover, this vulnerability must be treated as a priority. Administrators should apply the vendor-supplied patches immediately to mitigate the risk of unauthorized remote exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Sites
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A vulnerability in the Oracle WebCenter Sites component allows low-privileged attackers to compromise the application.

Executive Summary:
A high-severity vulnerability in Oracle WebCenter Sites enables low-privileged attackers to perform unauthorized actions and potentially seize control of the system.

Vulnerability Details

CVE-ID: CVE-2026-35318

Affected Software: Oracle WebCenter Sites

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability affects the WebCenter Sites component, allowing a low-privileged attacker with network access via HTTP to potentially compromise the server, leading to a complete takeover.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a significant risk to the security and integrity of the WebCenter Sites platform. Unauthorized exploitation could lead to the loss of sensitive corporate data and disruption of web content management operations.

Remediation Plan

Immediate Action: Apply the June 2026 Critical Security Patch Update provided by Oracle.

Proactive Monitoring: Monitor system logs for anomalous requests or unauthorized administrative activity within the WebCenter Sites environment.

Compensating Controls: Deploy WAF rules to inspect HTTP traffic and limit access to the application to known, trusted IP addresses where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation remains high.

Analyst Recommendation

It is critical that administrators apply the June 2026 Critical Security Patch Update immediately to address this vulnerability. Prompt patching is the most effective way to protect the WebCenter Sites environment from potential exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A vulnerability in the Content Server component of Oracle WebCenter Content allows low-privileged attackers to compromise the application.

Executive Summary:
A critical vulnerability in Oracle WebCenter Content allows low-privileged network-based attackers to compromise the application, leading to potential total takeover.

Vulnerability Details

CVE-ID: CVE-2026-35317

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: The vulnerability exists in the Content Server component and is easily exploitable by a low-privileged attacker with network access via HTTP, potentially allowing them to compromise the entire WebCenter Content environment.

Business Impact

The CVSS score of 8.8 reflects the high risk associated with this vulnerability. Successful exploitation could result in unauthorized access to sensitive business documents, data breach, and severe operational disruption.

Remediation Plan

Immediate Action: Apply the June 2026 Critical Security Patch Update to all affected WebCenter Content installations.

Proactive Monitoring: Monitor for unusual activity in the Content Server logs, particularly unauthorized attempts to access or modify administrative functions.

Compensating Controls: Use network-level controls and a WAF to restrict access to the application and mitigate potential exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation is high due to the nature of the flaw.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Security teams should deploy the June 2026 Critical Security Patch Update as soon as possible to mitigate the risk of unauthorized system compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle WebCenter Content server allows a low-privileged, network-adjacent attacker to achieve full system takeover via HTTP.

Executive Summary:
A critical vulnerability in Oracle WebCenter Content exposes the system to full takeover by low-privileged attackers via network-accessible HTTP interfaces.

Vulnerability Details

CVE-ID: CVE-2026-35316

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability affects the Content Server component of Oracle WebCenter Content. It is easily exploitable over HTTP by a low-privileged attacker, resulting in a scope change and complete compromise of the system.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a severe threat to the confidentiality and integrity of content managed within the platform. A successful exploit could result in the unauthorized exfiltration of sensitive documents, modification of enterprise content, and the potential for a total system takeover.

Remediation Plan

Immediate Action: Update Oracle WebCenter Content to the latest version by applying the patches provided by Oracle in the June 2026 security advisory.

Proactive Monitoring: Review audit trails and access logs for suspicious content access or modification activities that could indicate an attacker is leveraging this vulnerability.

Compensating Controls: Implement strict network access controls to the Content Server and utilize WAF filtering to prevent malicious HTTP requests from reaching the vulnerable interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The potential for total system takeover makes this vulnerability a top priority. IT teams must ensure that WebCenter Content instances are updated immediately to mitigate the risks associated with this critical flaw.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Content
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A vulnerability in the Content Server component of Oracle WebCenter Content allows low-privileged attackers to compromise the application.

Executive Summary:
A high-severity flaw in Oracle WebCenter Content allows attackers with minimal privileges to potentially gain full control of the application.

Vulnerability Details

CVE-ID: CVE-2026-35315

Affected Software: Oracle WebCenter Content

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability resides in the Content Server component, allowing a low-privileged attacker with network access via HTTP to exploit the system and potentially achieve a complete takeover of the Oracle WebCenter Content platform.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a substantial threat. Unauthorized access to WebCenter Content could lead to the exposure or manipulation of critical business documents and sensitive organizational records.

Remediation Plan

Immediate Action: Apply the June 2026 Critical Security Patch Update provided by Oracle.

Proactive Monitoring: Monitor application logs for unauthorized content access or unusual administrative operations within the Content Server.

Compensating Controls: Implement strict access control lists (ACLs) and use a WAF to inspect incoming HTTP requests for malicious patterns targeting the Content Server.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, the potential for exploitation is high given the nature of the vulnerability.

Analyst Recommendation

Organizations utilizing Oracle WebCenter Content must prioritize the application of the June 2026 Critical Security Patch Update. Prompt remediation is essential to prevent unauthorized access and protect the integrity of the content management infrastructure.

---METADATA---
VENDOR: Oracle
PRODUCT: Access Manager
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.1.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Access Manager authentication engine allows a low-privileged, network-adjacent attacker to achieve full system takeover via HTTP.

Executive Summary:
A critical vulnerability in Oracle Access Manager permits low-privileged attackers to gain full system control through the authentication engine.

Vulnerability Details

CVE-ID: CVE-2026-35313

Affected Software: Oracle Access Manager

Affected Versions: 12.2.1.4.0 and 14.1.2.1.0

Vulnerability: This vulnerability exists in the Authentication Engine of Oracle Access Manager. It is easily exploitable over HTTP by a low-privileged attacker, leading to a scope change and complete takeover of the Access Manager.

Business Impact

The CVSS score of 9.9 underscores the severe risk this vulnerability presents. As a core authentication component, a compromise of Oracle Access Manager could lead to widespread unauthorized access, credential theft, and the subversion of security controls across the entire enterprise application environment.

Remediation Plan

Immediate Action: Apply the latest security patches for Oracle Access Manager as detailed in the Oracle Security Alert for June 2026.

Proactive Monitoring: Monitor authentication logs for unusual behavior or high-frequency login failures, and review system logs for indicators of unauthorized administrative actions.

Compensating Controls: Deploy WAF rules designed to block malicious HTTP requests targeting the authentication engine and restrict access to the Access Manager console to known, secure IP ranges.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Securing the authentication engine is paramount. Given the high criticality of this vulnerability, administrators should expedite the patching of all Oracle Access Manager instances to prevent the potential for widespread security failure.

---METADATA---
VENDOR: Oracle
PRODUCT: Fusion Middleware (WebLogic Server)
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A vulnerability in the Core component of Oracle Fusion Middleware WebLogic Server allows low-privileged attackers to compromise the application.

Executive Summary:
A high-severity vulnerability in the Oracle WebLogic Server Core component enables unauthorized attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35311

Affected Software: Oracle Fusion Middleware (WebLogic Server)

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: The vulnerability exists in the WebLogic Server Core and is classified as easily exploitable, allowing a low-privileged attacker with HTTP network access to compromise the integrity and availability of the server.

Business Impact

The CVSS score of 8.8 underscores the critical nature of this flaw. Compromise of the WebLogic Core component can lead to total system takeover, endangering sensitive business data and the availability of critical middleware services.

Remediation Plan

Immediate Action: Apply the June 2026 Critical Security Patch Update to all affected WebLogic instances.

Proactive Monitoring: Monitor server logs for anomalous patterns in core service requests that deviate from established operational baselines.

Compensating Controls: Utilize network segmentation to restrict access to the WebLogic Server and implement WAF rules to block potentially malicious HTTP payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score and the nature of the flaw, the potential for exploitation is significant.

Analyst Recommendation

Security teams should treat this vulnerability with high urgency. Patching via the Oracle June 2026 Critical Security Patch Update is the only reliable method to mitigate the risk of remote exploitation and ensure the ongoing security of the middleware environment.

---METADATA---
VENDOR: Oracle
PRODUCT: Coherence
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
---END_METADATA---

Description Summary:
A critical flaw in the Oracle Coherence Centralized Third Party Jars component allows unauthenticated attackers to achieve full system compromise via network-accessible HTTP requests.

Executive Summary:
An unauthenticated remote attacker can compromise Oracle Coherence due to a critical vulnerability in its third-party library integration, necessitating urgent remediation.

Vulnerability Details

CVE-ID: CVE-2026-35308

Affected Software: Oracle Coherence

Affected Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: This vulnerability affects the Centralized Third Party Jars component within Oracle Coherence. It allows an unauthenticated attacker to remotely compromise the software over HTTP.

Business Impact

The CVSS score of 10.0 underscores the high-risk nature of this flaw. Exploitation allows for unauthorized control over the Coherence environment, which could result in data breaches and total loss of service availability for applications relying on the Coherence data grid.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches for the Coherence product immediately.

Proactive Monitoring: Review logs for evidence of exploitation attempts targeting the Coherence service and monitor for unexpected third-party library execution.

Compensating Controls: Ensure that the Coherence environment is not exposed to the public internet and use a WAF to inspect incoming traffic for known attack patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate action is required to mitigate this critical risk. Administrators must verify their Coherence versions and apply the latest security updates to prevent potential system-wide compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: Coherence
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Coherence core component allows unauthenticated attackers to compromise the application via network-accessible HTTP requests.

Executive Summary:
A critical vulnerability in Oracle Coherence permits an unauthenticated attacker to execute a full system takeover, representing a severe threat to enterprise middleware security.

Vulnerability Details

CVE-ID: CVE-2026-35307

Affected Software: Oracle Coherence

Affected Versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

Vulnerability: The vulnerability resides in the core component of Oracle Coherence. It is easily exploitable by an unauthenticated remote attacker through HTTP, resulting in a full takeover of the Coherence instance.

Business Impact

With a CVSS score of 10.0, this vulnerability represents a maximum-severity risk. Compromise of the Coherence layer can lead to unauthorized access to clustered data, disruption of critical business applications, and potential escalation to other connected components within the Fusion Middleware stack.

Remediation Plan

Immediate Action: Update all instances of Oracle Coherence to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor network traffic for unusual HTTP patterns directed at Coherence ports and audit system logs for unauthorized service access.

Compensating Controls: Implement strict network segmentation and egress filtering to isolate Coherence instances from untrusted network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw requires an immediate update strategy. Security teams should identify all instances of the affected Coherence versions and apply the necessary patches as a top-tier priority.

---METADATA---
VENDOR: Oracle
PRODUCT: Fusion Middleware (WebLogic Server)
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.1.0.0
---END_METADATA---

Description Summary:
A vulnerability exists in the Oracle Fusion Middleware WebLogic Server Console component that allows low-privileged network-based attackers to compromise the server.

Executive Summary:
A critical security vulnerability in Oracle WebLogic Server allows low-privileged attackers to gain unauthorized control via network exploitation.

Vulnerability Details

CVE-ID: CVE-2026-35303

Affected Software: Oracle Fusion Middleware (WebLogic Server)

Affected Versions: 12.2.1.4.0 and 14.1.1.0.0

Vulnerability: This is an easily exploitable vulnerability within the WebLogic Server Console component that allows an authenticated, low-privileged attacker with network access via HTTP to perform unauthorized actions, potentially leading to a complete server takeover.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure. Successful exploitation could result in a full compromise of the WebLogic environment, leading to data exfiltration, unauthorized administrative access, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Apply the June 2026 Critical Security Patch Update provided by Oracle immediately.

Proactive Monitoring: Review WebLogic access logs for suspicious administrative requests or unexpected HTTP activity originating from low-privileged accounts.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter malicious traffic directed at the WebLogic Console interface.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 18, 2026, public proof-of-concept exploits are available for this vulnerability. Given the ease of exploitation, the risk of active targeting is significantly elevated.

Analyst Recommendation

Due to the high severity and the availability of exploit code, organizations must prioritize patching this vulnerability. Failure to apply the June 2026 Critical Security Patch Update leaves the environment exposed to potential takeover attempts by low-privileged actors.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Console component of the Oracle WebLogic Server, potentially allowing for unauthorized system interaction.

Executive Summary:
A critical vulnerability in the Oracle WebLogic Server Console component poses a significant risk of unauthorized access and potential compromise of critical middleware infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35302

Affected Software: Oracle WebLogic Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Console component of WebLogic Server, which is a common target for remote management exploitation. Given the nature of the component, the vulnerability likely requires an authenticated session, though the scope of impact remains high.

Business Impact

The exploitation of this vulnerability could lead to a full compromise of the WebLogic environment, potentially resulting in unauthorized data access, service disruption, or lateral movement within the network. With a CVSS score of 8.3, this flaw is classified as High, indicating that the potential for significant operational impact is substantial.

Remediation Plan

Immediate Action: Identify all instances of Oracle WebLogic Server in the environment and prepare to apply the official vendor security patches as soon as they are released by Oracle.

Proactive Monitoring: Review WebLogic Server access logs for unusual administrative activity or unauthorized attempts to access the Console interface.

Compensating Controls: Implement strict network segmentation and restrict access to the WebLogic Console to known, trusted management IP addresses via a Web Application Firewall (WAF) or VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability with high priority, as middleware servers often serve as central hubs for business-critical applications. Security teams must monitor Oracle's official security portals for patch availability and ensure that all WebLogic instances are hardened against unauthorized access in the interim.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: 12.2.1.4.0, 14.1.1.0.0
---END_METADATA---

Description Summary:
An unauthenticated remote code execution vulnerability exists in the Oracle WebLogic Server Console component, allowing full system takeover via crafted HTTP requests.

Executive Summary:
This critical vulnerability in Oracle WebLogic Server allows an unauthenticated remote attacker to achieve a full system takeover, posing an extreme risk to infrastructure integrity.

Vulnerability Details

CVE-ID: CVE-2026-35301

Affected Software: Oracle WebLogic Server

Affected Versions: 12.2.1.4.0, 14.1.1.0.0

Vulnerability: This is a critical remote code execution vulnerability within the WebLogic Server Console. It is remotely exploitable by an unauthenticated attacker over HTTP with no user interaction required.

Business Impact

The CVSS 3.1 base score of 10.0 reflects the maximum severity of this flaw. Successful exploitation grants an attacker full control over the WebLogic environment, potentially leading to total data exfiltration, lateral movement within the network, and complete system compromise. This poses a catastrophic risk to organizational data confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest Oracle Critical Patch Update (CPU) immediately to patch the affected WebLogic Server versions.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting the Console component and monitor system process integrity for unauthorized execution.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter malicious traffic targeting WebLogic Console endpoints until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the CVSS score of 10.0 and the ease of exploitation, immediate patching is mandatory. Organizations must prioritize the deployment of vendor-supplied updates to prevent unauthorized system takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An unspecified vulnerability in the Console component of Oracle WebLogic Server could allow for unauthorized system impact or control.

Executive Summary:
Oracle WebLogic Server is affected by a high-severity vulnerability in its Console component that could facilitate unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-35299

Affected Software: Oracle WebLogic Server

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is located in the Console component of WebLogic Server. It involves an unspecified flaw that may allow an attacker to influence the state of the administrative console, potentially leading to unauthorized operations.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant threat to the security posture of the application server. Successful exploitation could lead to full administrative takeover, service outages, or the compromise of applications hosted within the WebLogic environment.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches to all affected WebLogic Server installations.

Proactive Monitoring: Monitor for unauthorized access to the WebLogic Console and track any changes made to server configurations or deployed applications.

Compensating Controls: Ensure that the WebLogic Console is restricted to internal, secure networks and implement multi-factor authentication (MFA) for all administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

WebLogic Server remains a high-value target for attackers. Administrators should expedite the application of security patches to mitigate risks associated with the Console component and ensure the environment remains resilient against potential exploitation.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager Connector
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.1.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle Identity Manager Connector enables a low-privileged, network-adjacent attacker to achieve full system takeover via HTTP.

Executive Summary:
A critical vulnerability in the Oracle Fusion Middleware Identity Manager Connector allows for full system takeover by low-privileged attackers via network-accessible HTTP interfaces.

Vulnerability Details

CVE-ID: CVE-2026-35294

Affected Software: Oracle Fusion Middleware (Identity Manager Connector)

Affected Versions: 12.2.1.4.0 and 14.1.2.1.0

Vulnerability: This vulnerability affects the Mainframe Connectors component of the Identity Manager Connector. It is easily exploitable over HTTP by a low-privileged attacker, resulting in a scope change and complete compromise of the component.

Business Impact

With a CVSS score of 9.9, this flaw poses a critical threat to identity management systems, which are central to organizational security. Successful exploitation could allow attackers to manipulate identity data, bypass authentication controls, and potentially pivot into other sensitive systems connected to the middleware.

Remediation Plan

Immediate Action: Update the Identity Manager Connector components to the latest version by following the instructions in the June 2026 Oracle security alert.

Proactive Monitoring: Implement enhanced logging for the Identity Manager Connector and audit HTTP traffic for unusual request patterns that could indicate exploitation attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming HTTP traffic for malicious payloads targeting the Identity Manager Connector.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Identity management infrastructure is a prime target for attackers; therefore, this vulnerability must be addressed as a high-priority security task. Administrators should prioritize the application of patches to prevent unauthorized takeover of the Identity Manager Connector.

---METADATA---
VENDOR: Oracle
PRODUCT: WebLogic Server
AFFECTED_VERSIONS: 14.1.2.0.0 and 15.1.1.0.0
---END_METADATA---

Description Summary:
A critical, unauthenticated remote code execution vulnerability in the Oracle WebLogic Server Console allows complete system takeover.

Executive Summary:
A critical, unauthenticated remote code execution vulnerability in Oracle WebLogic Server could allow an attacker to take full control of the application server.

Vulnerability Details

CVE-ID: CVE-2026-35292

Affected Software: Oracle WebLogic Server

Affected Versions: 14.1.2.0.0 and 15.1.1.0.0

Vulnerability: This vulnerability exists in the WebLogic Console component, allowing an unauthenticated attacker to send malicious HTTP requests to compromise the server. Because the vulnerability requires no user interaction or prior credentials, it represents an extremely high risk for remote code execution.

Business Impact

The CVSS score of 10.0 underscores the severe threat posed by this vulnerability. A successful attack can lead to a full takeover of the WebLogic Server, granting the attacker the ability to steal data, deploy backdoors, or pivot deeper into the corporate network, resulting in catastrophic business impact.

Remediation Plan

Immediate Action: Apply Oracle's June 2026 Critical Security Patch Update immediately to remediate the vulnerability in WebLogic Server.

Proactive Monitoring: Monitor network traffic for unusual HTTP patterns directed at the WebLogic console and audit server logs for suspicious process creation.

Compensating Controls: Deploy a WAF to block malicious payloads targeting the console and restrict external access to the WebLogic management interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: Oracle has historically noted that attackers have been successful because targeted customers failed to apply available patches. Therefore, the risk of exploitation is extremely high and immediate action is required.

Analyst Recommendation

This is a maximum-severity vulnerability that demands immediate patching. Given the history of exploitation in WebLogic environments, security teams should ensure that all instances are updated to the latest patch version as a matter of urgency to prevent full system compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture allows a low-privileged, network-adjacent attacker to achieve full system takeover via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture exposes the system to complete takeover by low-privileged attackers through network-accessible protocols.

Vulnerability Details

CVE-ID: CVE-2026-35285

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture and is reachable via T3 or IIOP protocols. It allows a low-privileged attacker to achieve a scope change and gain total control over the affected software.

Business Impact

The CVSS score of 9.9 reflects the extreme severity of this flaw, which enables full compromise of the application. The ability for an attacker to escalate privileges and impact the broader environment makes this a high-priority risk for organizations relying on Oracle Fusion Middleware for critical business operations.

Remediation Plan

Immediate Action: Upgrade WebCenter Enterprise Capture to the latest version as specified in the June 2026 Oracle security advisory.

Proactive Monitoring: Review access logs for suspicious activity, specifically monitoring for unusual remote connections using the T3 or IIOP protocols that deviate from established baselines.

Compensating Controls: Implement network segmentation and access control lists (ACLs) to limit access to the affected components, ensuring that only trusted entities can communicate via the vulnerable protocols.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate remediation. Organizations should audit their current middleware deployments to identify vulnerable versions and apply the necessary security updates provided by Oracle to prevent unauthorized takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture allows a low-privileged, network-adjacent attacker to achieve full system takeover via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture poses a severe risk of total system compromise due to an easily exploitable flaw in the Client Bundle component.

Vulnerability Details

CVE-ID: CVE-2026-35284

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This is a remote, easily exploitable vulnerability affecting the Client Bundle component, allowing a low-privileged authenticated user to trigger a full system takeover. The attack vector leverages T3 or IIOP protocols to achieve a scope change, potentially impacting other integrated Oracle products.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a critical risk to organizational data confidentiality, integrity, and availability. Successful exploitation grants an attacker full control over the application, which may lead to unauthorized data access, manipulation of enterprise content, and lateral movement into other critical infrastructure components within the Oracle Fusion Middleware ecosystem.

Remediation Plan

Immediate Action: Apply the relevant security patches provided in the Oracle Security Alert for June 2026 to update affected instances of WebCenter Enterprise Capture.

Proactive Monitoring: Monitor server logs for anomalous T3 or IIOP traffic patterns and investigate any unauthorized authentication or elevated activity originating from low-privileged accounts.

Compensating Controls: Restrict network access to the WebCenter Enterprise Capture management interfaces and utilize a Web Application Firewall (WAF) to filter malicious requests targeting these specific protocols.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high. The ease of remote execution makes immediate patching a priority.

Analyst Recommendation

Given the critical CVSS score of 9.9 and the potential for full system takeover, organizations must prioritize this update in their next maintenance cycle. System administrators should verify version numbers immediately and apply the vendor-supplied patches to neutralize the risk of remote compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle WebCenter Enterprise Capture Client Bundle allows low-privileged attackers to compromise the system via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture allows low-privileged, remote attackers to achieve full system takeover, creating a significant security risk for the enterprise.

Vulnerability Details

CVE-ID: CVE-2026-35283

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This flaw affects the Client Bundle component and is easily exploitable by a low-privileged attacker with network access via T3 or IIOP. Successful exploitation allows for complete takeover of the WebCenter Enterprise Capture instance.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a major threat to organizational security. Successful exploitation could lead to the unauthorized access of captured enterprise documents and data, potentially resulting in severe compliance and reputational impacts.

Remediation Plan

Immediate Action: Apply the vendor-recommended security updates as outlined in the Oracle security advisory (https://www.oracle.com/security-alerts/cspujun2026.html).

Proactive Monitoring: Regularly audit access logs for suspicious activity and monitor T3/IIOP traffic for signs of unauthorized access attempts.

Compensating Controls: Isolate the WebCenter Enterprise Capture server from untrusted networks and use firewall rules to restrict access to the necessary service ports.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The potential for full system compromise makes this a critical issue. Organizations should prioritize the deployment of the vendor's security patches immediately to effectively mitigate the risk.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle WebCenter Enterprise Capture Client Bundle allows low-privileged attackers to compromise the system via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture allows low-privileged attackers to gain full system control, presenting a severe risk to data and system integrity.

Vulnerability Details

CVE-ID: CVE-2026-35282

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability exists in the Client Bundle component of WebCenter Enterprise Capture. It is remotely exploitable by a low-privileged attacker using T3 or IIOP protocols, resulting in the potential for complete system takeover.

Business Impact

The CVSS score of 9.9 underscores the critical nature of this vulnerability. Unauthorized takeover of the capture infrastructure can lead to the exposure of sensitive documents, disruption of critical business processes, and potential escalation of privileges across the enterprise network.

Remediation Plan

Immediate Action: Update the affected software to the latest version by following the instructions in the Oracle security advisory (https://www.oracle.com/security-alerts/cspujun2026.html).

Proactive Monitoring: Monitor server logs for unauthorized T3 or IIOP access and watch for any irregularities in application performance or user account behavior.

Compensating Controls: Restrict access to the application server's T3/IIOP ports from external or untrusted networks as a temporary mitigation measure.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the extreme risk associated with this vulnerability, organizations should treat it as a high-priority incident. Immediate patching is required to protect the integrity and availability of the WebCenter Enterprise Capture product.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in the Oracle WebCenter Enterprise Capture Client Bundle allows low-privileged attackers to compromise the system via T3 or IIOP protocols.

Executive Summary:
A critical security flaw in Oracle WebCenter Enterprise Capture permits low-privileged, remote attackers to seize control of the application, posing an immediate threat to organizational security.

Vulnerability Details

CVE-ID: CVE-2026-35281

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: This vulnerability affects the Client Bundle component of WebCenter Enterprise Capture. An attacker with low privileges and network access to T3 or IIOP can trigger this flaw to achieve full takeover of the target application.

Business Impact

With a CVSS score of 9.9, this vulnerability poses a severe threat to the business, enabling attackers to gain unauthorized access to critical capture workflows. This could lead to data exfiltration, service disruption, and broader compromises of interconnected systems, necessitating immediate remediation to maintain security posture.

Remediation Plan

Immediate Action: Apply the relevant patches specified in the Oracle security advisory (https://www.oracle.com/security-alerts/cspujun2026.html).

Proactive Monitoring: Review system logs for suspicious T3/IIOP connection requests and monitor for anomalous behavior originating from low-privileged user accounts.

Compensating Controls: Implement strict network access controls to limit exposure of T3 and IIOP endpoints to trusted internal networks.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue demands immediate action. IT teams should prioritize patching affected WebCenter Enterprise Capture installations to neutralize the risk of unauthorized access and potential system takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: WebCenter Enterprise Capture
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.0.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture allows low-privileged attackers to gain full control of the application via T3 or IIOP network protocols.

Executive Summary:
A critical vulnerability in Oracle WebCenter Enterprise Capture enables remote, low-privileged attackers to achieve total system takeover, creating a severe risk of unauthorized data access and manipulation.

Vulnerability Details

CVE-ID: CVE-2026-35280

Affected Software: Oracle WebCenter Enterprise Capture

Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability: The flaw resides in the Client Bundle component of WebCenter Enterprise Capture. It allows a low-privileged attacker with network access via T3 or IIOP protocols to compromise the application, potentially impacting other associated systems due to the scope change.

Business Impact

This vulnerability carries a CVSS score of 9.9, indicating an extreme risk to the confidentiality, integrity, and availability of the affected environment. An attacker could gain unauthorized control over enterprise capture workflows, leading to the interception or alteration of sensitive business documents and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Oracle WebCenter Enterprise to the latest version by following the guidance in the Oracle security advisory (https://www.oracle.com/security-alerts/cspujun2026.html).

Proactive Monitoring: Audit access logs for unusual T3 or IIOP communication patterns and monitor for any unexplained modifications to capture configurations.

Compensating Controls: Utilize network segmentation to isolate the WebCenter Enterprise environment and restrict access to the affected ports to authorized personnel only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the ease of exploitation and the potential for full system takeover, this vulnerability should be treated with the highest priority. Administrators must apply the vendor-provided updates immediately to mitigate the risk of compromise.

---METADATA---
VENDOR: Oracle
PRODUCT: PeopleSoft Enterprise PeopleTools
AFFECTED_VERSIONS: 8.61 and 8.62
---END_METADATA---

Description Summary:
An unauthenticated, easily exploitable vulnerability in the PeopleSoft Updates Environment Management component allows for complete system takeover via HTTP.

Executive Summary:
A critical, unauthenticated remote code execution vulnerability in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 poses an extreme risk of system takeover.

Vulnerability Details

CVE-ID: CVE-2026-35273

Affected Software: Oracle PeopleSoft Enterprise PeopleTools

Affected Versions: 8.61 and 8.62

Vulnerability: The vulnerability exists in the Updates Environment Management component. It allows an unauthenticated attacker with network access to the HTTP interface to compromise the entire system through inadequate authentication mechanisms.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. Because it requires no authentication, the barrier for entry is exceptionally low, allowing attackers to perform a total takeover of the PeopleSoft environment. This could result in the compromise of highly sensitive organizational data, financial records, and operational disruption.

Remediation Plan

Immediate Action: Update to the latest version of Oracle PeopleSoft Enterprise PeopleTools immediately; consult the official Oracle security advisory for the relevant patch.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests targeting the Updates Environment Management component and review application logs for unauthorized access attempts or system configuration changes.

Compensating Controls: If immediate patching is not possible, restrict network access to the PeopleSoft HTTP interface using a Web Application Firewall (WAF) or by restricting access to authorized IP ranges only.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitability and the lack of authentication required, this vulnerability is a high-priority risk. Organizations must apply the vendor-provided patches without delay to prevent unauthorized system takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: PeopleSoft Enterprise PT PeopleTools
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the WebLogic component of Oracle PeopleSoft Enterprise PT PeopleTools.

Executive Summary:
A high-severity vulnerability in the WebLogic integration within Oracle PeopleSoft could allow an authenticated attacker to compromise the application server infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35271

Affected Software: Oracle PeopleSoft Enterprise PT PeopleTools

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the WebLogic integration layer within PeopleTools. An authenticated user could potentially exploit this flaw to perform unauthorized actions or gain excessive privileges within the PeopleSoft environment.

Business Impact

With a CVSS score of 8.7, this vulnerability threatens the confidentiality and availability of PeopleSoft business applications. Exploitation could result in unauthorized access to enterprise data, such as HR or financial records, and could lead to the total compromise of the application server.

Remediation Plan

Immediate Action: Apply the official Oracle security updates for PeopleSoft and the underlying WebLogic component as specified in the vendor advisory.

Proactive Monitoring: Monitor PeopleSoft and WebLogic server logs for signs of unauthorized administrative access or abnormal application behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect traffic destined for the PeopleSoft environment and block requests that match known exploitation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. Given the sensitivity of data handled by PeopleSoft, the risk of exploitation is considered high.

Analyst Recommendation

Organizations using PeopleSoft should treat this vulnerability with urgency. Administrators must verify their current patch level and apply the vendor’s security updates immediately to prevent potential unauthorized access to their core business systems.

---METADATA---
VENDOR: Oracle
PRODUCT: Fusion Middleware
AFFECTED_VERSIONS: 12.2.1.4.0 and 14.1.2.1.0
---END_METADATA---

Description Summary:
A critical vulnerability in Oracle Fusion Middleware Identity Manager allows low-privileged attackers to achieve a full system takeover via T3 or IIOP protocols.

Executive Summary:
A critical vulnerability in Oracle Fusion Middleware Identity Manager allows remote, low-privileged attackers to achieve a full system compromise, posing an extreme risk to organizational data integrity.

Vulnerability Details

CVE-ID: CVE-2026-35268

Affected Software: Oracle Fusion Middleware

Affected Versions: 12.2.1.4.0 and 14.1.2.1.0

Vulnerability: This is an easily exploitable vulnerability in the Core component of Identity Manager. It allows an authenticated, low-privileged attacker with network access to the T3 or IIOP protocols to execute unauthorized actions, leading to a complete takeover of the Identity Manager instance.

Business Impact

With a CVSS score of 9.9, this vulnerability represents a critical threat to business operations. Successful exploitation results in full system compromise, granting attackers the ability to manipulate sensitive identity data, bypass security controls, and potentially pivot to other integrated enterprise systems, leading to severe reputational damage and operational downtime.

Remediation Plan

Immediate Action: Apply the necessary security patches provided in the Oracle security advisory (https://www.oracle.com/security-alerts/cspujun2026.html) immediately.

Proactive Monitoring: Monitor network traffic for anomalous T3 or IIOP protocol activity and review system access logs for unauthorized administrative actions.

Compensating Controls: Restrict network access to T3 and IIOP ports to only known, authorized IP addresses and implement Web Application Firewall (WAF) rules to detect and block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity of 9.9, this vulnerability requires immediate attention. Security teams must prioritize applying the vendor-supplied patches to all affected Identity Manager instances to prevent unauthorized system takeover.

---METADATA---
VENDOR: Oracle
PRODUCT: Identity Manager
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the REST WebServices component of Oracle Identity Manager may allow for unauthorized manipulation of API-based identity services.

Executive Summary:
Oracle Identity Manager contains a high-severity vulnerability in its REST WebServices component, creating risks for API-based identity operations.

Vulnerability Details

CVE-ID: CVE-2026-35267

Affected Software: Oracle Identity Manager

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the REST WebServices interface of the Identity Manager. The flaw potentially allows for improper input handling or authentication bypass within the API layer, which could be leveraged to interact with the service in an unauthorized manner.

Business Impact

Given the CVSS score of 8.8, this vulnerability poses a severe threat to the integrity of automated identity processes. An attacker could potentially disrupt identity workflows, exfiltrate user data, or perform unauthorized administrative actions through the exposed API endpoints.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Oracle to the affected Identity Manager environment.

Proactive Monitoring: Analyze API access logs for anomalous requests, unexpected HTTP status codes, or patterns indicative of fuzzing or injection attempts.

Compensating Controls: Utilize an API Gateway to enforce strict schema validation and rate limiting on all REST WebServices endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 18, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

API-based vulnerabilities are increasingly common and often overlooked. It is imperative to patch the Identity Manager promptly to prevent attackers from exploiting the REST interface to bypass core security controls.