CVE-2026-35284: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote-code-execution class vulnerability affects Oracle WebCenter Enterprise Capture (Client Bundle component), versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via the T3 and IIOP protocols with only a low-privilege account, and requires no victim interaction. Successful exploitation gives an attacker full takeover of the affected instance, with scope change indicating impact can spread to additional products in the same environment. No upstream fix has been published yet; HarborGuard is tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 or IIOP protocol; internet- or intranet-exposed deployments are directly in scope.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No victim action is needed; the attacker can exploit the vulnerability entirely without user participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other unpredictable environmental factors.

Blast Radius

• Reads all data accessible to the WebCenter Enterprise Capture service, including captured documents, metadata, and stored credentials.
• Modifies or deletes persisted document records and configuration data within the application.
• Crashes or fully disables the WebCenter Enterprise Capture service, interrupting document capture workflows.
• Because the CVSS scope is changed, a successful attacker can pivot to compromise additional products and services running in the same Fusion Middleware environment.