CVE-2026-35270: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical remote takeover vulnerability exists in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires a high-privileged account, but no victim interaction. Successful exploitation gives an attacker full control over the Content Server instance, with impacts extending to confidentiality, integrity, and availability across additional connected products due to a scope change. No upstream fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content Server over the network via HTTP; no physical or local access is assumed.

• AuthenticationRequired

  A high-privileged account (such as an administrator credential) is needed to initiate the attack, though no lower-privilege escalation step is required first.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can exploit the vulnerability without any involvement from a legitimate user.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker achieves full takeover of the Oracle WebCenter Content instance, reading all stored content, metadata, and credentials held by the server.
• The attacker can modify or delete any content, configuration, or persisted data managed by Content Server, corrupting document workflows and audit trails.
• The Content Server process can be crashed or made unavailable, disrupting all dependent document management and publishing workflows.
• Because the CVSS scope is marked as Changed, exploitation can pivot to compromise additional Oracle Fusion Middleware products that trust or integrate with the affected Content Server.