CVE-2026-35326: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A high-severity vulnerability in Oracle WebCenter Content (Content Server component) allows a remote, authenticated attacker with administrative privileges to fully compromise the affected system via HTTP. The vulnerability requires no victim interaction and carries low attack complexity, making exploitation straightforward once the attacker has admin-level credentials. Successful exploitation gives the attacker complete control over the Content Server instance, affecting confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Content Server over the network via HTTP, making any internet- or intranet-exposed instance a viable target.

• AuthenticationRequired

  A high-privileged (admin-level) account is required; an attacker without existing administrative credentials cannot exploit this vulnerability directly.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning exploitation is reliable and imposes no special conditions such as race conditions or memory-layout requirements.

Blast Radius

• The attacker reads all content managed by the Content Server, including stored documents, metadata, and potentially credentials or session tokens held in the system.
• The attacker modifies or deletes managed content and configuration data, enabling persistent tampering with document repositories.
• The attacker crashes or destabilizes the Content Server process, taking the service offline for all users who depend on it.
• Full system takeover is achievable, meaning the attacker can install persistent backdoors or pivot to other systems accessible from the Content Server host.