CVE-2026-35285: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote code execution class vulnerability affects Oracle WebCenter Enterprise Capture (Client Bundle component), versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with a low-privilege account and network access over the T3 or IIOP protocols can exploit this flaw without any victim interaction, and successful exploitation results in full takeover of the affected product, with scope change meaning adjacent systems can also be compromised. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 or IIOP protocol, meaning the WebCenter Enterprise Capture endpoint must be accessible from the attacker's network position.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative or elevated credentials are required to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the affected system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, timing dependencies, or environmental prerequisites.

Blast Radius

• A successful attacker gains full control of the Oracle WebCenter Enterprise Capture instance, including all documents, capture workflows, and stored credentials it holds.
• All confidentiality, integrity, and availability of data within the product are lost: the attacker can read, modify, or permanently delete captured content and configuration.
• Because the CVSS scope is changed, other products sharing the same middleware environment or trust boundary can be compromised as a secondary consequence of this single attack.
• The attacker can crash or render the capture service unavailable, disrupting any downstream processes that depend on document ingestion.