CVE-2026-35319: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical unauthenticated remote code execution vulnerability affects Oracle WebCenter Content (Content Server component) in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over HTTP without any credentials or user interaction, making it trivially exploitable by any attacker with network access to the service. Successful exploitation results in full takeover of the Oracle WebCenter Content instance, giving the attacker control over confidentiality, integrity, and availability. No fix versions have been published by Oracle; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content service over the network via HTTP; there is no local-only or adjacent-network restriction.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is fully accessible to unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• A successful attacker gains full read access to all content managed by the Content Server, including documents, metadata, and stored credentials or session material.
• The attacker can write, modify, or delete persisted content and configuration data within the Oracle WebCenter Content instance.
• The attacker can crash or render the Content Server permanently unavailable, disrupting all workflows and integrations that depend on it.
• Full system takeover means the attacker can use the compromised host as a foothold for lateral movement into adjacent systems in the same network segment.