CVE-2026-35286: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical unauthenticated remote takeover vulnerability affects Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0. An attacker reachable over HTTP needs no credentials and no victim interaction to exploit the flaw. Successful exploitation gives the attacker full control of the Content Server instance, including read, write, and disruption of all hosted content. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Content Server over the network via HTTP; the service is exposed to anyone with network access to it.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated remote attacker.

• Victim interactionNot required

  No user action is required; the attacker triggers exploitation entirely without any involvement from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race wins, or environmental setup.

Blast Radius

• A successful attacker reads all content managed by the Content Server, including stored documents, metadata, and any credentials or tokens held in the repository.
• The attacker can write, modify, or delete persisted content and configuration data, corrupting or replacing managed documents and repository state.
• The attacker can crash or render the Content Server unavailable, denying access to all users and downstream systems that depend on it.
• Combined confidentiality, integrity, and availability compromise at the highest level constitutes a full takeover of the Oracle WebCenter Content instance.