CVE-2026-35320: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical unauthenticated remote vulnerability exists in the Content Server component of Oracle WebCenter Content (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0). An attacker with network access over HTTP, and no credentials whatsoever, can exploit this flaw to achieve full takeover of the affected system, including reads, writes, and denial of service across confidentiality, integrity, and availability. Because the CVSS vector includes a scope change, a successful attack can spill over and compromise other products beyond WebCenter Content itself. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; there is no requirement for local or physical access, making any internet- or intranet-exposed deployment a viable target.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action or social engineering is required; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit is not condition-free and likely depends on specific timing, configuration, or environmental factors the attacker must engineer or observe before the attack succeeds.

Blast Radius

• A successful attacker achieves full takeover of the Oracle WebCenter Content instance, reading all stored content, documents, and indexed metadata.
• The attacker can write or delete persisted content records and modify system configuration, corrupting the integrity of the content repository.
• The attacker can crash or render the Content Server unavailable, disrupting any workflows or applications that depend on it.
• Because the CVSS scope is Changed, the attacker can pivot to compromise other Fusion Middleware components or co-hosted products beyond WebCenter Content itself.