CVE-2026-35319: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-35319 Overview

CVE-2026-35319 is a critical improper access control vulnerability [CWE-284] in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access over HTTP can exploit the flaw to fully compromise Oracle WebCenter Content. Oracle disclosed the issue in its June 2026 Critical Patch Update advisory.

Critical Impact
Remote, unauthenticated attackers can achieve complete takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability of stored enterprise content.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-06-17 - CVE-2026-35319 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Patch Update — see the Oracle Security Alert

Technical Details for CVE-2026-35319

Vulnerability Analysis

The flaw resides in the Content Server component, which manages document ingestion, indexing, and delivery within Oracle WebCenter Content. Improper access control allows requests to reach privileged functionality without authentication. An attacker only needs network reachability to the HTTP listener to exercise the affected code path.

Successful exploitation grants full control over the WebCenter Content instance. This includes the ability to read, modify, or destroy managed content, manipulate metadata, and pivot into the underlying middleware tier. Oracle classifies the issue as resulting in takeover of the product, with high impact across all three CIA properties.

The EPSS probability is approximately 0.45% as of 2026-06-18, placing it in the 35.7th percentile. Exploitation likelihood is expected to rise once technical details circulate, given that comparable WebCenter Content issues have historically been weaponized.

Root Cause

The underlying weakness is classified as [CWE-284] Improper Access Control. The Content Server fails to enforce authentication or authorization checks on a network-reachable interface, allowing privileged operations to be invoked anonymously.

Attack Vector

The attack vector is network-based over HTTP, with low complexity and no required privileges or user interaction. An attacker sends crafted HTTP requests to an exposed Content Server endpoint and triggers the unprotected functionality. Oracle has not published exploitation specifics, and no public proof-of-concept code is currently available. See the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-35319

Indicators of Compromise

Unauthenticated HTTP requests to Content Server endpoints originating from external or untrusted networks
Unexpected administrative actions in Content Server audit logs, such as user creation, role changes, or component installations
New or modified files in WebCenter Content document repositories without corresponding workflow records
Outbound connections from the WebLogic/WebCenter Content host to attacker-controlled infrastructure

Detection Strategies

Inspect Content Server access logs for anonymous requests targeting administrative or service URLs
Correlate web server logs with WebCenter Content audit logs to identify privileged operations lacking authenticated sessions
Hunt for newly deployed custom components or Java classes in the $ORACLE_HOME/ucm directory tree
Compare current Content Server configuration baselines against known-good snapshots

Monitoring Recommendations

Forward Content Server, WebLogic, and reverse-proxy logs to a centralized analytics platform for retention and correlation
Alert on bursts of HTTP requests to Content Server service endpoints from a single source
Monitor process and file activity on middleware hosts for execution of shells, scripting interpreters, or unexpected binaries spawned by the WebLogic JVM

How to Mitigate CVE-2026-35319

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update fixes for Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0
Restrict network exposure of Content Server endpoints to trusted management networks until patching is complete
Review Content Server administrative accounts, components, and recently uploaded content for signs of tampering
Rotate credentials, API keys, and secrets stored within or accessible to the WebCenter Content environment

Patch Information

Oracle addressed CVE-2026-35319 in the June 2026 Critical Patch Update. Administrators should download and apply the platform-specific patches referenced in the Oracle Security Alert. Patching is the only fully effective remediation; configuration changes alone do not eliminate the underlying access control flaw.

Workarounds

Place Content Server behind an authenticating reverse proxy or web application firewall that blocks unauthenticated access to administrative paths
Apply IP allow-listing at the network or load-balancer tier to limit who can reach the Content Server HTTP listener
Disable or firewall off optional Content Server services and components that are not in active use

bash

# Example: restrict Content Server access at the network edge
# Replace 10.0.0.0/24 with your trusted administrative subnet
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP