CVE-2026-35282: Oracle WebCenter Privilege Escalation Flaw

CVE-2026-35282 Overview

CVE-2026-35282 affects Oracle WebCenter Enterprise Capture, a component of Oracle Fusion Middleware. The flaw resides in the Client Bundle and allows a low-privileged attacker with network access via T3 or IIOP protocols to fully compromise the product. Exploitation results in takeover of Oracle WebCenter Enterprise Capture, with scope change indicating impact extends to additional products beyond the vulnerable component. The vulnerability is classified under [CWE-284: Improper Access Control].

Critical Impact
A low-privileged remote attacker can take over Oracle WebCenter Enterprise Capture through T3 or IIOP, with cascading impact on other Fusion Middleware components due to scope change.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-06-17 - CVE-2026-35282 published to NVD
2026-06-17 - Oracle Security Alert CSPU Jun 2026 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35282

Vulnerability Analysis

The vulnerability stems from improper access control within the Client Bundle component of Oracle WebCenter Enterprise Capture. Oracle's advisory states that exploitation is easily achievable and requires only low privileges. The attacker reaches the vulnerable code path through the T3 or IIOP remote protocols, both used by WebLogic-based Fusion Middleware deployments for remote method invocation.

A successful attack results in full takeover of the WebCenter Enterprise Capture instance. The scope change attribute indicates that compromise propagates beyond the vulnerable component into other products within the same trust boundary, expanding blast radius across the Fusion Middleware stack.

Root Cause

Oracle categorizes the root cause as improper access control [CWE-284]. The Client Bundle exposes functionality through T3 and IIOP without enforcing sufficient authorization checks for the operations it accepts. Authenticated users with minimal privileges can therefore invoke privileged operations and pivot into administrative actions.

Attack Vector

The attack originates from the network. T3 is Oracle WebLogic's proprietary remote protocol, while IIOP is the CORBA-based Internet Inter-ORB Protocol. Both are commonly exposed on default WebLogic listen ports. An attacker authenticates with a low-privileged account and issues crafted remote invocations against the Client Bundle, bypassing intended access restrictions.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert CSPU Jun 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-35282

Indicators of Compromise

Unexpected inbound T3 or IIOP connections to WebLogic managed servers hosting WebCenter Enterprise Capture, particularly from non-administrative source addresses.
Authentication events for low-privileged WebCenter accounts followed by administrative actions or new user creation.
Anomalous deserialization activity or unusual class loading within Fusion Middleware audit and server logs.

Detection Strategies

Inspect WebLogic access logs and AdminServer.log for unusual T3/IIOP method invocations targeting Client Bundle classes.
Correlate authentication telemetry with subsequent privileged operations to identify privilege boundary violations.
Apply network detection rules for T3 (weblogic.t3) and IIOP traffic originating outside expected administrative segments.

Monitoring Recommendations

Enable WebLogic auditing at the highest verbosity for the WebCenter Capture domain and forward logs to a centralized analytics platform.
Alert on configuration changes, new application deployments, or scheduled job creation within WebCenter Enterprise Capture.
Monitor outbound connections from Fusion Middleware hosts for signs of lateral movement triggered by the scope-change impact.

How to Mitigate CVE-2026-35282

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert CSPU Jun 2026 to all affected WebCenter Enterprise Capture instances.
Inventory all Fusion Middleware deployments running versions 12.2.1.4.0 and 14.1.2.0.0 and prioritize internet-exposed systems.
Rotate credentials for low-privileged WebCenter accounts that may have been targeted prior to patching.

Patch Information

Oracle published fixes as part of the June 2026 Critical Security Patch Update. Administrators should download the patch corresponding to their Fusion Middleware version from My Oracle Support and follow Oracle's documented patching procedure for WebCenter Enterprise Capture. See the Oracle Security Alert CSPU Jun 2026 for the authoritative patch matrix.

Workarounds

Restrict access to WebLogic T3 and IIOP listen ports using network access control lists, allowing only trusted management hosts.
Disable IIOP on managed servers that do not require it through the WebLogic Administration Console.
Configure a WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3s and IIOP/IIOPs from untrusted sources.

bash

# Example WebLogic connection filter rules (Console: Domain > Security > Filter)
# Allow management subnet, deny all other T3/IIOP
10.10.0.0/24 * allow t3 t3s iiop iiops
0.0.0.0/0   * deny  t3 t3s iiop iiops