CVE-2026-35285: Oracle WebCenter Privilege Escalation Flaw

CVE-2026-35285 Overview

CVE-2026-35285 affects the Oracle WebCenter Enterprise Capture product within Oracle Fusion Middleware, specifically the Client Bundle component. The flaw allows a low-privileged attacker with network access via T3 or IIOP protocols to compromise Oracle WebCenter Enterprise Capture. Successful exploitation can result in full takeover of the affected product and impact additional downstream products due to a scope change. The vulnerability is categorized under [CWE-284] Improper Access Control.

Critical Impact
Network-accessible exploitation leads to complete takeover of Oracle WebCenter Enterprise Capture, with confidentiality, integrity, and availability impacts extending beyond the vulnerable component.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-06-17 - CVE-2026-35285 published to NVD
2026-06-17 - Last updated in NVD database
2026-06 - Oracle publishes Security Alert June 2026 addressing the issue

Technical Details for CVE-2026-35285

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, a document imaging product used to scan, index, and route content into enterprise content management systems. Oracle classifies this issue as easily exploitable, requiring only low-level privileges and no user interaction. Attackers reach the vulnerable code path through the T3 (Oracle WebLogic proprietary RMI protocol) and IIOP (Internet Inter-ORB Protocol) network interfaces.

Because the attack causes a scope change, exploitation impacts resources beyond the security authority of the WebCenter Enterprise Capture component itself. This commonly indicates that authenticated low-privilege access pivots into administrative control over related Fusion Middleware services. Oracle reports impacts to confidentiality, integrity, and availability, consistent with full product takeover.

Root Cause

The weakness is mapped to [CWE-284] Improper Access Control. The Client Bundle does not adequately enforce authorization checks on requests received over T3 and IIOP, allowing low-privileged callers to invoke functionality reserved for higher-privileged roles. T3 and IIOP have historically been a recurring attack surface in Fusion Middleware deployments because they expose Java object services to authenticated remote callers.

Attack Vector

An attacker authenticates to the target with low-level credentials and issues crafted T3 or IIOP requests to the WebCenter Enterprise Capture Client Bundle endpoints. The improper access control allows the attacker to execute privileged operations that lead to product takeover. No user interaction is required, and attack complexity is low. Refer to the Oracle Security Alert June 2026 for vendor-supplied technical context.

// No public proof-of-concept code is available for CVE-2026-35285.
// See Oracle Security Alert June 2026 for vendor technical details.

Detection Methods for CVE-2026-35285

Indicators of Compromise

Unexpected authenticated T3 or IIOP connections to Oracle WebCenter Enterprise Capture listeners from unusual source addresses
New or modified administrative accounts within WebCenter Enterprise Capture or linked Fusion Middleware services
Outbound connections from WebLogic managed servers hosting the Client Bundle to attacker-controlled infrastructure
Anomalous Java process spawn activity on the WebLogic host following T3 or IIOP traffic spikes

Detection Strategies

Inspect WebLogic access and audit logs for repeated low-privilege bindings followed by privileged operation calls on Capture endpoints
Correlate IIOP and T3 traffic with subsequent process execution, file writes, or credential changes on the middleware host
Hunt for deserialization patterns and suspicious class loading events in WebLogic diagnostic logs

Monitoring Recommendations

Forward WebLogic, Capture, and host telemetry to a centralized analytics platform for correlation and retention
Alert on any T3 or IIOP traffic originating from outside defined administrative network segments
Monitor for changes to WebCenter Enterprise Capture configuration files and scheduled tasks

How to Mitigate CVE-2026-35285

Immediate Actions Required

Apply the patches from the Oracle Security Alert June 2026 to versions 12.2.1.4.0 and 14.1.2.0.0
Restrict T3 and IIOP access to trusted management networks using WebLogic connection filters
Audit and revoke unnecessary low-privilege accounts that can authenticate to WebCenter Enterprise Capture
Review Fusion Middleware administrative accounts for unauthorized changes since June 2026

Patch Information

Oracle released fixes as part of the June 2026 Security Alert cycle. Administrators should apply the cumulative patches for Oracle Fusion Middleware that address Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Security Alert June 2026 advisory for patch identifiers and prerequisite bundle versions.

Workarounds

Configure WebLogic weblogic.security.net.ConnectionFilterImpl to deny T3 and IIOP from untrusted sources
Disable IIOP on managed servers where it is not required for business functionality
Place WebCenter Enterprise Capture behind a reverse proxy that terminates only required HTTP(S) traffic

bash

# Example WebLogic connection filter rules to restrict T3 and IIOP
# Configure under: Domain > Security > Filter > Connection Filter Rules
10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops