CVE-2026-35283: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical-severity remote code execution vulnerability affects Oracle WebCenter Enterprise Capture (Client Bundle), versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via the T3 and IIOP protocols using any low-privilege account, with no victim interaction needed, and carries a scope-change rating meaning a successful attacker can pivot beyond the compromised component. Exploitation results in full takeover of Oracle WebCenter Enterprise Capture, including complete control over confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 or IIOP protocol; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the service directly without any victim involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental setup.

Blast Radius

• Reads all data stored within Oracle WebCenter Enterprise Capture, including captured documents, metadata, and stored credentials.
• Modifies or deletes persisted capture jobs, document records, and configuration data within the application.
• Crashes or renders the Oracle WebCenter Enterprise Capture service unavailable, disrupting document ingestion workflows.
• Because the CVSS scope is changed, a successful attacker can extend access to additional co-hosted Oracle Fusion Middleware components beyond the directly compromised product.