CVE-2026-35281: Oracle WebCenter Auth Bypass Vulnerability

CVE-2026-35281 Overview

CVE-2026-35281 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically within the Client Bundle component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access through the T3 or IIOP protocols can exploit this issue to compromise Oracle WebCenter Enterprise Capture. The vulnerability has a scope change, meaning successful exploitation can impact additional products beyond the affected component. Successful attacks result in full takeover of Oracle WebCenter Enterprise Capture with high impact to confidentiality, integrity, and availability. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
Authenticated network-based attackers can take over Oracle WebCenter Enterprise Capture and impact additional products through scope change.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-06-17 - CVE-2026-35281 published to NVD
2026-06-17 - Last updated in NVD database
2026-06-17 - Oracle Critical Patch Update advisory released

Technical Details for CVE-2026-35281

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture. Oracle WebCenter Enterprise Capture is part of the Oracle Fusion Middleware stack and provides document and image capture services that feed downstream content management systems. The flaw is reached over the network through Oracle's proprietary T3 protocol or the CORBA-based Internet Inter-ORB Protocol (IIOP), both of which are used by Oracle WebLogic and Fusion Middleware components for remote method invocation.

An authenticated attacker with low privileges can leverage the exposed protocol surface to gain control of the Oracle WebCenter Enterprise Capture service. The scope change indicates that the vulnerable component executes operations affecting resources outside its own security authority, allowing the attack to extend to other Oracle Fusion Middleware products sharing the same trust boundary.

Root Cause

The root cause is improper access control [CWE-284] in the Client Bundle component. The component fails to adequately enforce authorization checks on operations invoked through T3 and IIOP interfaces. This allows a low-privileged authenticated user to invoke privileged operations they should not be able to call.

Attack Vector

The attack vector is network-based with low attack complexity and requires only low privileges. No user interaction is required. An attacker reaches the vulnerable service by sending crafted T3 or IIOP requests to an exposed Oracle WebCenter Enterprise Capture instance. Because T3 and IIOP are commonly used for cluster communication and administrative tooling, internet-exposed or improperly segmented deployments significantly increase the attack surface.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert for vendor-supplied technical context.

Detection Methods for CVE-2026-35281

Indicators of Compromise

Unexpected inbound connections to T3 (7001/tcp, 7002/tcp) or IIOP listener ports from non-administrative sources.
Creation of new administrative users, scheduled jobs, or workflow definitions in WebCenter Enterprise Capture without a corresponding change ticket.
Unusual deserialization activity or exceptions in WebLogic and Capture server logs referencing the Client Bundle component.
Outbound network traffic originating from the WebCenter Capture host to unrecognized external endpoints.

Detection Strategies

Inspect WebLogic access logs for anomalous T3 and IIOP authentication patterns, particularly authentications from low-privileged accounts followed by privileged operations.
Monitor for spawned child processes from the WebLogic Java process (java.exe or java) that deviate from baseline behavior.
Correlate file system writes under the WebCenter Capture deployment directories with the originating remote session.

Monitoring Recommendations

Enable verbose auditing for WebLogic administrative operations and forward logs to a central SIEM with retention sufficient for incident review.
Alert on any successful low-privileged user invoking management or configuration APIs on the Capture service.
Track scope-crossing activity such as Capture-originated calls into adjacent Fusion Middleware components.

How to Mitigate CVE-2026-35281

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert on all WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 instances.
Inventory all Oracle Fusion Middleware deployments and confirm which hosts run WebCenter Enterprise Capture and expose T3 or IIOP.
Restrict network reachability of T3 and IIOP ports to trusted management subnets using firewall rules or network ACLs.
Audit and prune low-privileged accounts that have authenticated access to the Capture service.

Patch Information

Oracle published the fix as part of the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert and apply the corresponding patch level for each affected version. Oracle Critical Patch Updates are cumulative for Fusion Middleware, so applying the latest bundle addresses this and related issues.

Workarounds

Configure the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources until patches are deployed.
Disable IIOP on managed servers that do not require it through the WebLogic Administration Console.
Place WebCenter Enterprise Capture behind a reverse proxy or jump host and block direct T3/IIOP exposure at the perimeter.

bash

# Example WebLogic connection filter rule to restrict T3/IIOP to a management subnet
# Set in: Domain > Security > Filter > Connection Filter Rules
10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0   * * deny  t3 t3s iiop iiops