CVE-2026-35283: Oracle WebCenter Privilege Escalation Flaw

CVE-2026-35283 Overview

CVE-2026-35283 is an improper access control vulnerability [CWE-284] in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access through the T3 or Internet Inter-ORB Protocol (IIOP) can exploit the issue to take over Oracle WebCenter Enterprise Capture. The vulnerability carries a scope change, meaning successful exploitation can impact additional products beyond the vulnerable component.

Critical Impact
Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture with high impact to confidentiality, integrity, and availability across connected products.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-06-17 - CVE-2026-35283 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35283

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, an enterprise document imaging and capture solution within Oracle Fusion Middleware. The flaw is categorized as improper access control [CWE-284], where the affected component fails to enforce sufficient authorization restrictions on operations exposed through Oracle's Remote Method Invocation protocols.

Exploitation occurs over the network through the T3 or IIOP protocols, which Oracle WebLogic Server uses for remote object communication. Because the issue has a scope change, attacker actions performed against WebCenter Enterprise Capture can propagate to other products that trust or share resources with the vulnerable component. This expands the blast radius beyond a single application boundary.

A successful attack yields full takeover of WebCenter Enterprise Capture, which typically holds business-critical scanned documents, invoices, and contracts. The combined high impact on confidentiality, integrity, and availability indicates the attacker gains administrative control over stored data and runtime behavior.

Root Cause

The root cause is insufficient authorization enforcement [CWE-284] within the Client Bundle. Remote invocations reaching the component through T3 or IIOP are processed without adequately validating the caller's privileges against the requested operations.

Attack Vector

The attack vector is network-based with low attack complexity. The attacker requires only low-level authenticated access on the target environment and no user interaction. By issuing crafted requests over T3 or IIOP to the WebLogic listener fronting WebCenter Enterprise Capture, the attacker can invoke privileged operations and compromise the application. Refer to the Oracle Security Alert for vendor-specific technical guidance.

Detection Methods for CVE-2026-35283

Indicators of Compromise

Unexpected T3 or IIOP connections to WebLogic listener ports (default 7001, 7002) from non-administrative hosts.
New or modified administrative accounts within Oracle WebCenter Enterprise Capture.
Unusual outbound connections originating from the WebCenter Capture managed server JVM.
Anomalous access patterns to captured document repositories or batch processing queues.

Detection Strategies

Inspect WebLogic access and audit logs for repeated T3/IIOP authentication attempts from unusual source addresses.
Correlate Fusion Middleware audit events with privileged operations on the Client Bundle component.
Baseline normal RMI traffic volume and alert on deviations targeting WebCenter Capture managed servers.

Monitoring Recommendations

Forward WebLogic Server, Fusion Middleware audit, and OS-level logs to a centralized analytics platform.
Monitor file system and database changes tied to the WebCenter Capture schema for unauthorized writes.
Track process creation on Fusion Middleware hosts to detect post-exploitation tooling launched from the Java process tree.

How to Mitigate CVE-2026-35283

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert on all affected WebCenter Enterprise Capture deployments.
Restrict network access to WebLogic T3 and IIOP listener ports to trusted administrative subnets only.
Review and reduce privileges for service and application accounts that can reach the WebCenter Capture endpoint.
Audit existing WebCenter Capture accounts and revoke any that are unused or unauthorized.

Patch Information

Oracle addressed CVE-2026-35283 in its June 2026 Critical Patch Update. Administrators must apply the patches listed in the Oracle Security Alert for Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Use a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted networks.
Disable IIOP on managed servers that do not require it through the WebLogic Server Administration Console.
Place the WebCenter Capture managed servers behind a reverse proxy or firewall that terminates external RMI access.

bash

# Example WebLogic connection filter rules to block T3/IIOP from untrusted networks
# Set in: Domain > Security > Filter > Connection Filter Rules
10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops