CVE-2026-35321: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical-severity vulnerability affects the Content Server component of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware. The flaw is reachable over HTTP from the network and requires only a low-privilege account, with no victim interaction needed; the scope of impact extends beyond the directly compromised component to additional products in the environment. Successful exploitation gives an attacker full takeover of Oracle WebCenter Content, including complete control over confidentiality, integrity, and availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content Server over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative credentials are required, but the attacker must hold at least one valid user account.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• Reads all content stored in Oracle WebCenter Content, including documents, records, and associated metadata.
• Modifies or deletes persisted content and configuration data within the Content Server.
• Crashes or renders the Content Server unavailable, disrupting all workflows and integrations that depend on it.
• Pivots to additional products and services in the same environment due to the scope change indicated in the CVSS vector.