CVE-2026-35323 Overview
CVE-2026-35323 is a critical access control vulnerability [CWE-284] in Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw resides in the Content Server component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit this vulnerability to take over Oracle WebCenter Content. The scope change indicates that successful exploitation impacts resources beyond the vulnerable component, extending the blast radius to additional products in the deployment. Oracle disclosed the issue in its June 2026 Security Alert.
Critical Impact
Authenticated attackers with low privileges can fully compromise Oracle WebCenter Content over the network, with cascading impact to adjacent products due to scope change.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Oracle Fusion Middleware deployments using the Content Server component
Discovery Timeline
- 2026-06-17 - CVE-2026-35323 published to NVD
- 2026-06-17 - Oracle releases Oracle Security Alert June 2026
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-35323
Vulnerability Analysis
The vulnerability stems from improper access control [CWE-284] in the Oracle WebCenter Content Server. An attacker authenticated with low privileges can issue HTTP requests that bypass intended authorization checks. Successful exploitation results in complete takeover of the Content Server, with high impact to confidentiality, integrity, and availability.
The scope change is the defining characteristic of this flaw. Compromise of the WebCenter Content component propagates to additional products that trust or integrate with the Content Server, amplifying the impact across the Fusion Middleware stack. EPSS data places exploitation probability at 0.389% as of June 2026, but the low attacker requirements raise the practical risk profile.
Root Cause
The root cause is a missing or insufficient authorization control on a Content Server interface reachable by authenticated users. The control fails to constrain low-privileged accounts from invoking privileged operations, allowing them to act outside their assigned role and reach sensitive Content Server functions.
Attack Vector
The attack vector is network-based over HTTP. The attacker needs valid low-privileged credentials and no user interaction. Attack complexity is low, meaning no special timing, configuration, or environmental conditions are required. After authentication, the attacker sends crafted HTTP requests to the Content Server endpoint to achieve takeover and pivot into integrated products.
No public proof-of-concept code is available at this time. Refer to the Oracle Security Alert June 2026 for vendor-supplied technical context.
Detection Methods for CVE-2026-35323
Indicators of Compromise
- Unexpected HTTP requests to Oracle WebCenter Content Server endpoints from low-privileged user accounts.
- New or modified administrative content items, configuration changes, or workflow definitions created by non-administrative accounts.
- Outbound connections or queries from the Content Server to integrated Fusion Middleware products outside normal operational baselines.
- Authentication events for service or low-privilege accounts followed by privileged Content Server operations.
Detection Strategies
- Inspect Content Server access logs for low-privileged users invoking administrative URLs or service calls.
- Correlate WebLogic and Content Server audit logs to identify privilege boundary violations.
- Baseline normal API usage per role and alert on deviations, particularly bulk content operations or configuration changes.
Monitoring Recommendations
- Forward Oracle WebCenter Content, WebLogic, and HTTP server logs to a centralized SIEM for retention and correlation.
- Monitor for cross-product activity originating from the Content Server identity, since scope change extends impact to integrated products.
- Alert on failed-then-successful authorization patterns that may indicate enumeration of vulnerable endpoints.
How to Mitigate CVE-2026-35323
Immediate Actions Required
- Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert June 2026 to all affected WebCenter Content deployments.
- Inventory all Oracle Fusion Middleware instances running versions 12.2.1.4.0 and 14.1.2.0.0 and prioritize internet-exposed systems.
- Rotate credentials for low-privileged accounts that interact with Content Server and review their assigned roles.
- Audit Content Server logs for suspicious activity dating back to before patch deployment.
Patch Information
Oracle published fixes in the June 2026 Critical Patch Update. Customers should follow the version-specific patch instructions in the Oracle Security Alert June 2026 and validate patch application in a staging environment before promoting to production.
Workarounds
- Restrict network access to the Content Server to trusted management networks using firewall rules or reverse proxy ACLs.
- Enforce least privilege on WebCenter Content accounts and disable unused low-privileged accounts until patching completes.
- Place a web application firewall in front of the Content Server to block anomalous HTTP request patterns targeting administrative endpoints.
- Increase audit log verbosity on Content Server and forward logs to a SIEM until patching is verified across the environment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
