CVE-2026-35321 Overview
CVE-2026-35321 is a critical access control vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit this issue to take over Oracle WebCenter Content. The vulnerability carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component itself. Oracle disclosed the issue in the Oracle Security Alert published June 2026. The weakness is classified under [CWE-284] (Improper Access Control).
Critical Impact
Successful exploitation results in full takeover of Oracle WebCenter Content, with high impact to confidentiality, integrity, and availability across additional in-scope products.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware (Content Server component)
Discovery Timeline
- 2026-06-17 - CVE-2026-35321 published to NVD
- 2026-06-17 - Last updated in NVD database
- June 2026 - Oracle releases Oracle Security Alert June 2026
Technical Details for CVE-2026-35321
Vulnerability Analysis
The vulnerability resides in the Content Server component of Oracle WebCenter Content. An authenticated attacker holding only low privileges can issue HTTP requests that bypass access control checks. The attack complexity is low, and no user interaction is required. The scope change attribute indicates that the vulnerable component can affect resources owned by other security authorities, expanding the blast radius beyond Oracle WebCenter Content itself.
Successful exploitation results in complete takeover of Oracle WebCenter Content, granting the attacker control over stored content, configuration, and integrated downstream systems. The EPSS probability is 0.389% as of 2026-06-18, indicating limited observed exploitation activity at publication. Oracle has not released full technical details beyond the security alert summary.
Root Cause
The vulnerability is categorized under [CWE-284] Improper Access Control. The Content Server component fails to correctly enforce authorization restrictions for actions reachable by authenticated low-privilege users. This allows actions that should be restricted to administrators to be performed by lower-privileged accounts.
Attack Vector
The attack vector is network-based over HTTP. An attacker requires valid low-privileged credentials to the Oracle WebCenter Content interface. From there, crafted HTTP requests targeting the Content Server component bypass access control checks. Because the issue is easily exploitable and scope-changing, a single authenticated session can pivot to control adjacent products that trust the compromised WebCenter Content instance. No proof-of-concept code or public exploit is available at the time of publication. See the Oracle Security Alert June 2026 for vendor guidance.
Detection Methods for CVE-2026-35321
Indicators of Compromise
- Unexpected administrative actions performed by low-privileged WebCenter Content accounts.
- Anomalous HTTP requests targeting Content Server endpoints from authenticated sessions.
- Creation of new privileged users, roles, or content security groups outside normal change windows.
- Outbound connections from the WebCenter Content host to unfamiliar destinations following authenticated HTTP activity.
Detection Strategies
- Monitor Oracle WebCenter Content access logs for privilege boundary violations and role escalation events.
- Correlate HTTP request patterns with user role assignments to identify low-privilege accounts invoking privileged operations.
- Alert on configuration changes, content security model modifications, and component deployments performed by non-administrative principals.
Monitoring Recommendations
- Forward Content Server audit logs and web tier access logs to a centralized SIEM with retention sufficient for retrospective analysis.
- Baseline normal HTTP request volumes and endpoints per user role, then alert on deviations.
- Track authentication events for low-privileged accounts that subsequently perform high-impact operations.
How to Mitigate CVE-2026-35321
Immediate Actions Required
- Apply the patches referenced in the Oracle Security Alert June 2026 to versions 12.2.1.4.0 and 14.1.2.0.0.
- Inventory all Oracle WebCenter Content deployments and confirm version exposure.
- Restrict network access to the Content Server HTTP interface to trusted management networks where feasible.
- Audit existing WebCenter Content accounts and remove unused or excessive low-privilege accounts that could serve as a foothold.
Patch Information
Oracle released fixes as part of the Oracle Security Alert published June 2026. Administrators should consult the Oracle Security Alert June 2026 for patch identifiers, applicability matrices, and installation prerequisites. Apply the patches following Oracle's documented Fusion Middleware patching procedure, including pre-patch backups and post-patch validation of Content Server functionality.
Workarounds
- No vendor-supplied workaround replaces the patch; prioritize patch deployment.
- Limit HTTP access to Content Server endpoints via network segmentation, reverse proxy allowlists, or firewall rules until patching is complete.
- Enforce strong authentication and multi-factor authentication for all WebCenter Content user accounts to reduce the population of attackers able to meet the low-privilege precondition.
# Configuration example: restrict access to Content Server at the web tier
# (Apache httpd reverse proxy in front of WebCenter Content)
<Location /cs>
Require ip 10.10.0.0/16
Require ip 10.20.5.0/24
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
