CVE-2026-35270: Oracle WebCenter Content Privilege Escalation

CVE-2026-35270 Overview

CVE-2026-35270 is a critical access control vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An authenticated attacker with high privileges and network access via HTTP can compromise the product and trigger a scope change that impacts additional Oracle products. Successful exploitation results in full takeover of Oracle WebCenter Content, with high impact to confidentiality, integrity, and availability. Oracle addressed the issue in its June 2026 Critical Patch Update advisory. The vulnerability maps to CWE-284: Improper Access Control.

Critical Impact
Authenticated attackers can achieve complete takeover of Oracle WebCenter Content and pivot to additional Oracle products due to scope change.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware deployments using the Content Server component

Discovery Timeline

2026-06-17 - CVE-2026-35270 published to the National Vulnerability Database
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Security Patch Update advisory

Technical Details for CVE-2026-35270

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content, the enterprise content management product within Oracle Fusion Middleware. Oracle classifies the flaw as easily exploitable over HTTP by a high-privileged authenticated attacker. The scope change indicator means a successful exploit breaches the security boundary of the vulnerable component and affects resources managed by other security authorities. This significantly amplifies the blast radius beyond WebCenter Content itself, potentially reaching integrated Oracle Fusion Middleware services. Oracle reports high impact to confidentiality, integrity, and availability, consistent with full product takeover.

Root Cause

The weakness is categorized under CWE-284: Improper Access Control. The Content Server fails to correctly restrict actions available to authenticated users with elevated roles, allowing those users to perform operations that should be isolated from their privilege scope. Oracle's advisory does not publicly disclose the specific code path or API endpoint, consistent with Oracle's Critical Patch Update disclosure practices.

Attack Vector

Exploitation requires network reachability to the WebCenter Content HTTP interface and authenticated access at a high privilege level. No user interaction is required. The attacker leverages the access control flaw to manipulate Content Server operations and gain administrative control. The scope change in the CVSS vector indicates the attack can affect components beyond the initial vulnerable service. Technical exploitation details are not publicly available. Refer to the Oracle Critical Security Patch Update Advisory - June 2026 for vendor guidance.

Detection Methods for CVE-2026-35270

Indicators of Compromise

Unexpected administrative actions performed in Content Server audit logs by accounts that do not normally exercise those privileges
Anomalous HTTP requests to WebCenter Content management endpoints originating from unusual source addresses or at unusual times
New or modified Content Server configuration items, components, or user role assignments that lack a corresponding change ticket
Outbound connections from the WebCenter Content host to unexpected internal Fusion Middleware services, indicating lateral movement after scope change

Detection Strategies

Inventory all Oracle WebCenter Content instances and confirm versions against 12.2.1.4.0 and 14.1.2.0.0 to identify exposed systems
Review Content Server audit logs for privileged operations, focusing on accounts with administrator or system integrator roles
Correlate WebCenter Content HTTP access logs with authentication events to surface sessions exhibiting privilege misuse
Monitor process and file integrity on WebCenter Content hosts for deployment of custom components or modifications to config.cfg

Monitoring Recommendations

Ingest Oracle WebCenter Content access, audit, and WebLogic server logs into a centralized SIEM with retention sufficient for incident review
Alert on privilege role changes, new administrator accounts, and Content Server component installations
Baseline normal HTTP request patterns to the Content Server and alert on deviations from privileged accounts
Track and alert on outbound network connections from the WebCenter Content host that cross trust boundaries within Fusion Middleware

How to Mitigate CVE-2026-35270

Immediate Actions Required

Apply the patches listed in the Oracle June 2026 Critical Patch Update to all WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 instances
Audit all accounts holding high-privilege roles in WebCenter Content and remove unnecessary administrative assignments
Rotate credentials for privileged WebCenter Content service accounts after patching
Restrict network access to the Content Server HTTP interface to authorized administrative networks only

Patch Information

Oracle published the fix as part of the June 2026 Critical Security Patch Update. Administrators should consult the Oracle Security Alert advisory for the exact patch identifiers applicable to each affected version. Patches must be applied through Oracle's standard Fusion Middleware patching tooling, with associated WebLogic Server restarts as documented in the readme files accompanying each patch. Test patches in a staging environment before promoting to production due to the scope-changing nature of the fix.

Workarounds

Oracle does not document a configuration-only workaround. Patching is required to remediate the vulnerability
As a compensating control, place the Content Server behind a reverse proxy or web application firewall that enforces strict authentication and request filtering for administrative paths
Enforce network segmentation so that the WebCenter Content host cannot reach unrelated Fusion Middleware services, limiting impact from the scope change
Enable verbose audit logging on Content Server and forward to an external collector to preserve evidence in case of compromise

bash

# Example: restrict access to WebCenter Content administrative paths at the reverse proxy
location ~* ^/(cs|adfAuthentication|_dav)/ {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://webcenter-content-backend;
}