CVE-2026-35323: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A critical remote code execution vulnerability affects the Content Server component of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware. The flaw is reachable over HTTP by any low-privileged authenticated user with network access, and the attack is straightforward with no special conditions required. Successful exploitation gives an attacker full control of the Content Server and can spill over to compromise additional products in the same environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or other environmental setup.

Blast Radius

• A successful attacker gains full control of the Oracle WebCenter Content server, including the ability to read all managed documents, stored credentials, and indexed content.
• The attacker can modify or delete content records, configuration, and persisted data within the Content Server.
• The Content Server process can be crashed or made permanently unavailable, disrupting document management workflows.
• Because the CVSS scope is changed, the attacker can pivot to compromise other products and services sharing the same Fusion Middleware environment.