CVE-2026-35282: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote code execution vulnerability affects Oracle WebCenter Enterprise Capture (Client Bundle component), versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with a low-privilege account and network access via the T3 or IIOP protocols can reach the vulnerable service without any victim interaction, and the scope of impact extends beyond the directly compromised product. Successful exploitation results in full takeover of Oracle WebCenter Enterprise Capture, including complete loss of confidentiality, integrity, and availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 or IIOP protocol; internet-exposed or internally network-accessible deployments are directly at risk.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the service directly without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Reads all data stored within Oracle WebCenter Enterprise Capture, including captured documents and associated metadata.
• Modifies or deletes persisted content, workflow configurations, and application data within the platform.
• Crashes or otherwise disables the Oracle WebCenter Enterprise Capture service, halting document capture operations.
• Because the CVSS scope is changed, adjacent or downstream products integrated with Oracle WebCenter Enterprise Capture can also be compromised through lateral movement.