CVE-2026-35324: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

An unspecified high-severity vulnerability affects the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware, in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no user interaction needed. Successful exploitation gives an attacker full takeover of the affected WebCenter Content instance, impacting confidentiality, integrity, and availability. No fix has been published yet; HarborGuard is tracking the advisory and will surface a patched rebuild the moment Oracle ships a corrected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Content Server over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the system; unauthenticated access is not sufficient.

• Victim interactionNot required

  No action from a legitimate user is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental variables.

Blast Radius

• A successful attacker reads all content, documents, and credentials stored in the WebCenter Content repository.
• The attacker modifies or deletes persisted content, metadata, and configuration within the Content Server.
• The attacker crashes or renders the Content Server unavailable, disrupting dependent workflows and integrations.
• Combined control over confidentiality, integrity, and availability amounts to full instance takeover.