CVE-2026-35325: Oracle WebCenter Content Privilege Escalation

CVE-2026-35325 Overview

CVE-2026-35325 is a high-severity vulnerability in the Content Server component of Oracle WebCenter Content, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise the affected system and achieve full takeover. Oracle disclosed the issue in its June 2026 Critical Patch Update.

The vulnerability impacts confidentiality, integrity, and availability of the target instance. Because authentication requirements are minimal and the attack vector is network-based, exposed WebCenter Content servers are reachable targets for opportunistic and targeted exploitation.

Critical Impact
Successful exploitation results in complete takeover of Oracle WebCenter Content, exposing stored documents, business records, and downstream Fusion Middleware integrations.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware (Content Server component)

Discovery Timeline

2026-06-17 - CVE-2026-35325 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database
June 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-35325

Vulnerability Analysis

The vulnerability resides in the Content Server component of Oracle WebCenter Content. Oracle classifies the flaw as easily exploitable, requiring only HTTP network access and low-level authenticated privileges. The weakness maps to [CWE-284] Improper Access Control, indicating that the Content Server fails to correctly restrict actions that authenticated users can perform.

A successful attack pivots a standard low-privileged account into full administrative control over the WebCenter Content instance. This includes access to stored enterprise content, configuration data, and the ability to alter or destroy managed records. The user interaction requirement is none, so exploitation can be fully scripted once valid HTTP credentials are obtained.

Root Cause

Improper access control within the Content Server allows protected operations to be invoked by accounts that should not possess the required authorization. The component does not adequately validate the privilege boundary between standard users and administrative functions exposed over HTTP.

Attack Vector

An attacker authenticates to the Content Server with any low-privileged account and issues HTTP requests targeting the vulnerable endpoint. No social engineering or user interaction is required. The scope remains unchanged, but the compromise yields high impact across confidentiality, integrity, and availability of the WebCenter Content deployment.

No verified public proof-of-concept code is available at the time of writing. Refer to the Oracle Security Alert for vendor technical details.

Detection Methods for CVE-2026-35325

Indicators of Compromise

Unexpected administrative actions performed by non-administrative WebCenter Content accounts
Spikes in HTTP requests to Content Server administrative or management endpoints from low-privileged user sessions
New, modified, or deleted content items inconsistent with documented business workflows
Creation of new privileged users, roles, or credentials inside the WebCenter Content user store

Detection Strategies

Review Content Server access logs for authenticated requests from standard users hitting administrative URLs or APIs
Correlate authentication events with privilege changes inside Oracle Fusion Middleware audit trails
Compare current Content Server roles, security groups, and account lists against a known-good baseline
Hunt for anomalous outbound connections originating from the WebCenter Content host, which may indicate post-takeover activity

Monitoring Recommendations

Forward Content Server, WebLogic, and OS audit logs to a centralized SIEM or data lake for retention and correlation
Alert on bulk content export, mass deletion, or configuration changes performed by individual user sessions
Monitor for the addition of accounts to the sysmanager or other privileged WebCenter roles
Track HTTP request anomalies against the Content Server using web application firewall telemetry

How to Mitigate CVE-2026-35325

Immediate Actions Required

Apply the patches delivered in the Oracle June 2026 Critical Patch Update to all affected Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments
Inventory all internal and internet-facing WebCenter Content instances and prioritize externally reachable systems
Audit existing WebCenter Content accounts and revoke credentials that are inactive, shared, or no longer required
Rotate passwords for all low-privileged accounts that interact with the Content Server

Patch Information

Oracle addressed CVE-2026-35325 in the June 2026 Critical Patch Update. Fixes are available for Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0. Apply the relevant bundle patch through Oracle Support and follow the post-patch validation steps documented in the Oracle Security Alert.

Workarounds

Restrict HTTP access to the Content Server using network segmentation, VPN, or zero-trust access controls until patching completes
Place WebCenter Content behind a web application firewall with rules limiting access to administrative endpoints
Enforce strong, unique credentials and multi-factor authentication on all upstream identity providers used by WebCenter Content
Increase audit logging verbosity on the Content Server to capture pre-patch exploitation attempts

bash

# Configuration example: restrict Content Server HTTP access at the network edge
# Example iptables rule allowing only the trusted application tier to reach port 16200
iptables -A INPUT -p tcp --dport 16200 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP