CVE-2026-35315: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-35315 Overview

CVE-2026-35315 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, affecting the Content Server component. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful exploitation can result in complete takeover of the affected system, impacting confidentiality, integrity, and availability. The vulnerability is mapped to CWE-284: Improper Access Control. Oracle published the fix in its June 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can take over Oracle WebCenter Content over the network via HTTP, achieving full compromise of confidentiality, integrity, and availability.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware Content Server component

Discovery Timeline

2026-06-17 - CVE-2026-35315 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Patch Update

Technical Details for CVE-2026-35315

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content, an enterprise content management platform within Oracle Fusion Middleware. An attacker who already holds low-level authenticated access to the application can issue crafted HTTP requests to the Content Server and gain control over the product. Oracle classifies the issue as easily exploitable, meaning no specialized conditions are required beyond network reachability and a valid low-privileged account.

The scope remains unchanged, but impacts on confidentiality, integrity, and availability are all rated high. Successful exploitation results in takeover of the WebCenter Content instance, exposing managed documents, metadata, workflows, and any integrated downstream systems.

Root Cause

The underlying weakness is categorized as CWE-284: Improper Access Control. The Content Server fails to properly enforce authorization checks on certain HTTP-accessible operations, allowing an authenticated user with minimal privileges to perform actions that should be restricted to administrative roles. Oracle has not publicly disclosed the affected endpoint or function to limit exploitation risk.

Attack Vector

The attack vector is network-based and requires HTTP access to the Content Server. The attacker must possess valid low-privilege credentials, which can be obtained through phishing, credential stuffing, prior compromise, or self-registration in misconfigured deployments. No user interaction is required. Once authenticated, the attacker sends crafted HTTP requests to the vulnerable Content Server endpoint to escalate privileges and seize control of the instance.

No public proof-of-concept code or exploit module is currently available. The EPSS data places near-term in-the-wild exploitation probability in the lower range, but Oracle Fusion Middleware components have historically attracted post-disclosure exploit development.

Detection Methods for CVE-2026-35315

Indicators of Compromise

Unexpected administrative actions performed by low-privileged Content Server accounts, including changes to user roles, security groups, or content metadata.
Anomalous HTTP POST or GET requests to Content Server service endpoints originating from accounts that do not typically interact with administrative functions.
Creation of new administrative users, components, or scheduled jobs in the WebCenter Content management console without an associated change ticket.
Outbound network connections from the WebCenter Content host to unfamiliar IP addresses following authenticated HTTP activity.

Detection Strategies

Audit Content Server access logs (IdcServer and web tier logs) for service calls that bypass expected role checks or return successful responses to non-privileged users.
Correlate authentication events with privileged operations to identify accounts performing actions inconsistent with their assigned role.
Deploy file integrity monitoring on WebCenter Content configuration directories to detect unauthorized component installs or configuration changes.

Monitoring Recommendations

Forward Oracle WebCenter Content audit logs, WebLogic access logs, and operating system logs to a centralized SIEM with retention sufficient for incident reconstruction.
Establish behavioral baselines for service-account and low-privilege user activity, alerting on deviations such as access to administrative IDC services.
Monitor egress traffic from the WebCenter Content host for command-and-control patterns and data staging following suspicious HTTP activity.

How to Mitigate CVE-2026-35315

Immediate Actions Required

Apply the patches included in the Oracle Critical Patch Update Advisory - June 2026 to all WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 instances.
Inventory all Oracle Fusion Middleware deployments and confirm patch level before exposing Content Server to untrusted networks.
Rotate credentials for all Content Server user accounts, particularly any account that may have been used to test or trigger the issue.
Review audit logs from the period before patching for indicators of exploitation, focusing on privilege changes and component installations.

Patch Information

Oracle addressed CVE-2026-35315 in the June 2026 Critical Patch Update. Administrators should consult the official Oracle Security Alert for the exact patch identifiers, prerequisites, and post-installation steps. Oracle's CPU patches are cumulative for Fusion Middleware, so applying the June 2026 release also delivers fixes for previously disclosed issues.

Workarounds

Restrict network access to the Content Server HTTP endpoints using firewall rules or reverse-proxy ACLs, limiting connectivity to trusted administrative networks until patching completes.
Enforce multi-factor authentication on all WebCenter Content user accounts to raise the bar for the low-privilege access required by this vulnerability.
Disable or remove unused low-privilege accounts and tighten role assignments to minimize the population of users that could exploit the flaw.
Place the application behind a web application firewall with rules to inspect and rate-limit anomalous requests to Content Server service URLs.

bash

# Example: restrict Content Server HTTP access to a trusted admin subnet (iptables)
iptables -A INPUT -p tcp --dport 16200 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP

# Example: verify installed WebCenter Content version before/after patching
$ORACLE_HOME/OPatch/opatch lspatches | grep -i webcenter