CVE-2026-35280: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote-code-execution vulnerability affects Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0), reachable over the network via the T3 and IIOP protocols using any low-privilege account. Successful exploitation gives an attacker full takeover of the affected product, with a scope change meaning the impact can extend to adjacent systems and components beyond the directly targeted service. No vendor patch has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle releases a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 or IIOP protocol; the service must be network-exposed for exploitation to succeed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials, but must authenticate to the service.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the vulnerability entirely without involving a logged-in user.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to trigger the vulnerability.

Blast Radius

• A successful attacker gains full control over the Oracle WebCenter Enterprise Capture service, including the ability to read all stored documents, captured data, and session credentials.
• The attacker can modify or delete persisted capture workflows, document records, and configuration data.
• The attacker can crash or permanently disable the Capture service, halting document-processing operations.
• Because the CVSS scope is marked as changed, a successful attacker can pivot from the compromised Capture instance to other products and services sharing the same middleware environment.