CVE-2026-35281: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote code execution vulnerability affects Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0), reachable over the network via the T3 and IIOP protocols with only a low-privilege account. Exploitation results in full takeover of the affected product, and the scope change in the CVSS vector means successful attacks can cascade into compromising additional systems beyond the initial target. No fix versions have been published by Oracle as of the CVE publication date; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Enterprise Capture service over the network via the T3 or IIOP protocol (AV:N).

• AuthenticationRequired

  The attacker must hold any low-privilege account; no elevated or administrative credentials are needed (PR:L).

• Victim interactionNot required

  No user interaction or social engineering is necessary; the attacker can exploit the vulnerability entirely on their own (UI:N).

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental factors required to succeed (AC:L).

Blast Radius

• A successful attacker achieves full takeover of the Oracle WebCenter Enterprise Capture instance, reading all stored documents, credentials, and session data held by the service.
• The attacker can modify or delete persisted capture workflows, document records, and configuration data within the compromised product.
• The service can be crashed or made unavailable, disrupting any business process dependent on the capture pipeline.
• Because the CVSS scope is changed (S:C), the attacker can pivot from the compromised WebCenter instance to compromise additional products or services that share the same host, network segment, or trust boundary.