CVE-2026-35286: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-35286 Overview

CVE-2026-35286 is a critical vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically within the Content Server component. The flaw allows an unauthenticated attacker with network access via HTTP to fully compromise affected installations. Oracle has confirmed that supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The vulnerability is classified under [CWE-306: Missing Authentication for Critical Function], permitting attackers to bypass authentication entirely and reach sensitive Content Server functionality. Successful exploitation results in a complete takeover of the WebCenter Content instance, exposing confidentiality, integrity, and availability of stored enterprise content.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebCenter Content servers over HTTP without user interaction.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-06-17 - CVE-2026-35286 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-35286

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content, the document and content management module of Oracle Fusion Middleware. An unauthenticated attacker can reach sensitive functionality over HTTP without credentials or user interaction. Oracle describes the issue as easily exploitable, with full compromise of confidentiality, integrity, and availability. Because WebCenter Content typically stores regulated business documents, contracts, and records, takeover provides direct access to high-value enterprise data and a pivot point into adjacent Fusion Middleware services.

Root Cause

The weakness is categorized as [CWE-306: Missing Authentication for Critical Function]. A privileged code path within Content Server is exposed without enforcing authentication, allowing remote callers to invoke operations reserved for authorized users. The scope is unchanged, meaning the attacker operates within the security context of the vulnerable WebCenter Content process itself.

Attack Vector

Exploitation occurs over the network using HTTP requests directed at the Content Server endpoint. No prior authentication, elevated privileges, or user interaction are required. Attackers can script mass scanning for exposed Oracle WebCenter Content deployments and chain successful takeovers with credential harvesting, lateral movement, or deployment of webshells inside the Fusion Middleware stack. Oracle has not released technical exploit details, and no public proof-of-concept has been observed at the time of publication.

Refer to the Oracle Critical Patch Update Advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-35286

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Content Server URIs that succeed without a valid session cookie or Authorization header.
New or modified administrative users, content profiles, or component definitions in the WebCenter Content repository.
Unexpected files written under the Content Server vault, weblayout, or custom component directories.
Outbound connections initiated by the WebLogic managed server hosting WebCenter Content to unfamiliar hosts.

Detection Strategies

Inspect WebCenter Content access logs for anomalous IdcService calls (for example CHECKIN_UNIVERSAL, UPLOAD_NEW, GET_USER_INFO) originating from external IP ranges.
Alert on HTTP 200 responses to Content Server endpoints where the request lacked authentication headers or used default service accounts.
Correlate WebLogic audit events with process creation on the underlying host to surface post-exploitation activity such as spawned shells or java invoking system commands.

Monitoring Recommendations

Forward Oracle HTTP Server, WebLogic, and Content Server logs to a centralized analytics platform with retention sufficient for incident response.
Baseline normal IdcService traffic patterns and trigger on sudden spikes from single source addresses.
Monitor file integrity on Content Server installation directories and custom component folders for unauthorized changes.

How to Mitigate CVE-2026-35286

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update referenced in the June 2026 Oracle Security Alert to all WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to Content Server administrative interfaces using firewall rules, reverse proxies, or web application firewall policies until patches are deployed.
Audit WebCenter Content user accounts, custom components, and recently uploaded content for signs of unauthorized modification.

Patch Information

Oracle addressed CVE-2026-35286 in the June 2026 Critical Patch Update. Administrators should download the corresponding patches for Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 from My Oracle Support and follow the documented Fusion Middleware patching procedure, including OPatch application against the WebLogic Oracle home and any required post-patch configuration steps.

Workarounds

Place WebCenter Content behind an authenticating reverse proxy that enforces session validation before requests reach the Content Server.
Block external access to Content Server administrative URIs at the perimeter and limit them to trusted management networks.
Disable any unused Content Server services and custom components to reduce the exposed attack surface until patches are applied.

bash

# Example: restrict Content Server access at the perimeter (illustrative)
# Allow only trusted management subnet to reach the Content Server port
iptables -A INPUT -p tcp --dport 16200 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP