CVE-2026-35316: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical remote code execution class vulnerability affects Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires only a low-privilege account, with no victim interaction needed; the CVSS scope-change indicator means exploitation can spill beyond the Content Server process itself. Successful exploitation gives an attacker full takeover of the affected instance, covering read access to all stored content, modification of data, and complete service disruption, with potential impact on adjacent systems in the same environment. No upstream fix has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; no local or physical access is required, making any internet- or intranet-exposed deployment in scope.

• AuthenticationRequired

  A low-privilege account is sufficient; any valid user credential grants the attacker the access level needed to trigger the vulnerability.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can exploit the flaw directly without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions.

Blast Radius

• Reads all content stored in the WebCenter Content repository, including documents, metadata, and credentials or tokens persisted by the application.
• Modifies or deletes managed content, configuration records, and persisted application state.
• Crashes or permanently disrupts the Content Server service, taking document management workflows offline.
• Due to scope change, compromise can extend to other products or services sharing the same host or network segment, giving the attacker a foothold beyond the initial target.