CVE-2026-35327: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server)

Synopsis

A cross-site scripting or similar client-side injection vulnerability affects Oracle WebCenter Content (Content Server component), versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is reachable over HTTPS by any low-privileged authenticated user, but requires a victim to interact with attacker-controlled content, and its scope extends beyond the directly attacked product. Successful exploitation gives the attacker read access to all data accessible within Oracle WebCenter Content and limited write access (insert, update, delete) to some of that data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Content service over a network connection via HTTPS; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated but does not need administrative or elevated rights.

• Victim interactionRequired

  A person other than the attacker must interact with attacker-controlled content (such as visiting a crafted URL or viewing a malicious payload), making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker reads all data accessible to the compromised Oracle WebCenter Content instance, including stored documents, metadata, and user records.
• The attacker performs unauthorized inserts, updates, or deletes against a subset of Oracle WebCenter Content data, allowing tampering with managed content or configuration records.
• Because the CVSS scope is marked as changed, impact can extend to other products or services that share session context, trust relationships, or data with Oracle WebCenter Content.