CVE-2026-35315: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

This is a high-severity vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full takeover of the affected Oracle WebCenter Content instance, impacting confidentiality, integrity, and availability. No fix version has been published by Oracle at this time; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privileged account on the system is sufficient; anonymous access alone is not enough to exploit this vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads all content, documents, and metadata stored in the Oracle WebCenter Content repository, including any sensitive or access-controlled files.
• Modifies or deletes persisted content, repository metadata, and configuration data held by the Content Server.
• Crashes or degrades the Content Server service, making document management and retrieval unavailable to dependent applications and users.
• Achieves full system takeover, potentially enabling lateral movement to other services or hosts reachable from the compromised Content Server.