CVE-2026-35284: Oracle WebCenter Auth Bypass Vulnerability

CVE-2026-35284 Overview

CVE-2026-35284 is an access control vulnerability [CWE-284] in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can exploit the issue to take over Oracle WebCenter Enterprise Capture. The vulnerability carries a scope change, meaning successful exploitation impacts components beyond the vulnerable product itself.

Critical Impact
Network-reachable, low-privilege attackers can compromise confidentiality, integrity, and availability of Oracle WebCenter Enterprise Capture and impact additional downstream products through scope change.

Affected Products

Oracle Fusion Middleware
Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0

Discovery Timeline

2026-06-17 - CVE CVE-2026-35284 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35284

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture. Oracle classifies the flaw as easily exploitable across the network with low attack complexity. The defect is categorized under improper access control [CWE-284], indicating that authorization enforcement around exposed remote interfaces does not adequately restrict actions a low-privileged user can perform. Successful exploitation results in takeover of Oracle WebCenter Enterprise Capture and propagates impact to other products through a scope change, affecting confidentiality, integrity, and availability.

Root Cause

The root cause is improper access control on operations exposed by the Client Bundle to remote callers. Authenticated users with minimal privileges can invoke functionality that should require higher authorization, enabling complete product takeover. Because Oracle Fusion Middleware components frequently delegate trust between modules, the missing access checks allow lateral effects on dependent systems.

Attack Vector

The attack vector is the network. The attacker leverages the T3 protocol or IIOP, both Remote Method Invocation transports used by Oracle WebLogic Server and Fusion Middleware. T3 and IIOP endpoints are commonly accessible to authenticated application users and are recurring vectors for serialization and access control flaws in WebLogic-based stacks. Exploitation requires only low privileges and no user interaction. Oracle has not disclosed proof-of-concept code, and no public exploit is available at this time. Consult the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-35284

Indicators of Compromise

Unexpected T3 or IIOP connections to WebCenter Enterprise Capture managed servers from non-administrative hosts.
New or modified administrator-equivalent accounts in WebCenter Enterprise Capture following remote RMI activity.
Anomalous Java process spawning from WebLogic managed servers hosting the Capture Client Bundle.
Outbound connections from Fusion Middleware hosts to untrusted networks shortly after T3/IIOP traffic spikes.

Detection Strategies

Inspect WebLogic access and audit logs for T3 and IIOP requests from unexpected source addresses or low-privilege accounts.
Correlate authentication events with subsequent privileged operations in the Capture Client Bundle.
Hunt for unusual deserialization stack traces or weblogic.rjvm errors in server logs that often accompany RMI-based exploitation.
Monitor egress from middleware hosts for command-and-control patterns following authenticated remote invocations.

Monitoring Recommendations

Forward WebLogic server, audit, and access logs to a centralized SIEM for retention and correlation.
Alert on first-seen client IPs connecting to T3/IIOP listener ports.
Track configuration changes to WebCenter Enterprise Capture roles, batch profiles, and import profiles.
Review scheduled job and connector activity for unauthorized modifications.

How to Mitigate CVE-2026-35284

Immediate Actions Required

Apply Oracle's Critical Security Patch Update referenced in the Oracle Security Alert to all affected WebCenter Enterprise Capture deployments.
Restrict network exposure of T3 and IIOP listeners to trusted management networks only.
Audit and reduce privileges for accounts that can authenticate to the Capture Client Bundle.
Rotate credentials and review administrative accounts for unauthorized changes.

Patch Information

Oracle addresses CVE-2026-35284 in the June 2026 Critical Security Patch Update. Patches are available for versions 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Security Alert for the specific patch identifiers, prerequisites, and post-installation verification steps.

Workarounds

Configure WebLogic Connection Filters to deny T3 and IIOP traffic from untrusted sources until patches are applied.
Disable IIOP on managed servers where it is not required for business functionality.
Place WebCenter Enterprise Capture behind a reverse proxy or network segmentation boundary that blocks direct RMI access.
Enforce least privilege on all Capture application roles and remove unused accounts.

bash

# Example WebLogic Connection Filter rule to restrict T3/IIOP access
# Set in WebLogic Admin Console: Security Realms > myrealm > General > Connection Filter
# Filter class: weblogic.security.net.ConnectionFilterImpl
# Rules (one per line):
10.0.0.0/8    * * allow t3 t3s iiop iiops
0.0.0.0/0     * * deny  t3 t3s iiop iiops