CVE-2026-35325: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A high-severity vulnerability exists in the Oracle WebCenter Content product (Content Server component) of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no user interaction needed. Successful exploitation gives an attacker full control of the Content Server instance, impacting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  No user interaction is required; the attacker can exploit the vulnerability entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads all content managed by the Content Server, including stored documents, metadata, and any credentials or tokens held in the system.
• The attacker can modify or delete persisted content records, configuration, and access-control settings within the affected WebCenter Content instance.
• The attacker can crash or render the Content Server unavailable, disrupting document management and any workflows that depend on it.
• Full system takeover is achievable, meaning the attacker can install persistent backdoors or pivot to other services reachable from the compromised host.