CVE-2026-35322: Oracle WebCenter Auth Bypass Vulnerability

CVE-2026-35322 Overview

CVE-2026-35322 is an access control vulnerability [CWE-284] in Oracle WebCenter Content, a component of Oracle Fusion Middleware. The flaw resides in the Content Server component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit this issue without user interaction. Successful exploitation results in full takeover of Oracle WebCenter Content, impacting confidentiality, integrity, and availability.

Critical Impact
Authenticated attackers can take over Oracle WebCenter Content over the network with low complexity, compromising stored enterprise content and connected services.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-06-17 - CVE-2026-35322 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-35322

Vulnerability Analysis

The vulnerability exists in the Content Server component of Oracle WebCenter Content. It is classified under [CWE-284] Improper Access Control, indicating that the Content Server fails to correctly enforce access restrictions on a network-facing function. The flaw is reachable over HTTP and requires only low-level authentication, meaning standard application users can invoke the vulnerable code paths. Successful exploitation yields complete takeover of the WebCenter Content instance, granting attackers access to stored documents, application configuration, and downstream integrations within Oracle Fusion Middleware. The current EPSS probability is 0.389%, reflecting the absence of public exploit code at publication time.

Root Cause

The root cause is improper access control within the Content Server HTTP request handling layer. The component does not adequately validate that the requesting principal is authorized to perform the targeted operation, allowing low-privileged sessions to escalate to administrative actions. Oracle has not published implementation specifics. Refer to the Oracle Security Alert for advisory details.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates with any low-privileged account, then issues crafted requests to the Content Server endpoint exposing the unprotected function. No user interaction is required, and the attack scope remains unchanged. The combination of network reachability, low complexity, and minimal privilege requirements makes this issue practical against any internet-exposed or intranet-reachable WebCenter Content deployment.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert for vendor-specific technical references.

Detection Methods for CVE-2026-35322

Indicators of Compromise

Unexpected HTTP requests to Content Server administrative endpoints from accounts with standard user roles
New or modified administrator accounts in WebCenter Content audit logs
Unusual document downloads, profile changes, or workflow modifications performed by low-privileged users
Outbound connections from the WebCenter Content host to unfamiliar destinations following authenticated sessions

Detection Strategies

Monitor Content Server access logs for HTTP requests where low-privileged sessions invoke privileged service names or IdcCommand operations
Correlate authentication events with subsequent privilege-sensitive operations to surface authorization anomalies
Hunt for sequences of requests that bypass typical UI workflows and target administrative service handlers directly

Monitoring Recommendations

Enable verbose auditing in WebCenter Content and forward logs to a centralized analytics platform
Alert on changes to user role assignments, security groups, and component configuration
Track process and file activity on the WebCenter Content host to detect post-exploitation persistence or webshell deployment

How to Mitigate CVE-2026-35322

Immediate Actions Required

Apply Oracle's June 2026 Critical Patch Update for WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 without delay
Restrict network access to the Content Server to trusted networks and VPN users only
Audit existing WebCenter Content user accounts and remove unused or stale low-privileged accounts
Review audit logs for suspicious authenticated requests since the publication date

Patch Information

Oracle addressed CVE-2026-35322 in the June 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for patch identifiers, prerequisites, and post-installation verification steps. Apply the patch in non-production environments first and validate Content Server integrations before promoting to production.

Workarounds

Place WebCenter Content behind a reverse proxy or web application firewall that restricts access to administrative service endpoints
Enforce strong authentication and short session lifetimes to limit the window for credential abuse
Segment the WebCenter Content host from general user networks and limit outbound connectivity

bash

# Example: restrict Content Server admin paths at the reverse proxy
location ~* /cs/idcplg {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://webcenter-backend;
}