CVE-2026-35317: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A high-severity vulnerability in Oracle WebCenter Content (Content Server component) allows a network-accessible attacker with any low-privilege account to fully compromise the system via HTTP. No physical access or victim interaction is required, and the exploit is reliable with no special conditions needed. Successful exploitation gives the attacker complete control over the affected Oracle WebCenter Content instance, including full read, write, and availability impact. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; there is no local-only or adjacent-network restriction.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed, but unauthenticated access alone is not enough to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is required; the attacker can exploit the vulnerability without involving any other party.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race conditions, or configuration dependencies.

Blast Radius

• A successful attacker reads all content managed by the Content Server, including stored documents, metadata, and any credentials or tokens the application holds.
• The attacker can write to or modify any content, configuration, or persisted data within the Oracle WebCenter Content instance.
• The attacker can crash or make the Content Server unavailable, disrupting any workflows or integrations that depend on it.
• Full system takeover is the described outcome, meaning the attacker gains persistent control over the host process and its data without further escalation steps.