CVE-2026-35326 Overview
CVE-2026-35326 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware. The flaw resides in the Content Server component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with high privileges and network access via HTTP can exploit this issue to fully compromise Oracle WebCenter Content. Successful exploitation results in complete takeover of the affected instance, with impact to confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284: Improper Access Control.
Critical Impact
Successful exploitation enables an authenticated, high-privileged attacker to take over Oracle WebCenter Content over the network.
Affected Products
- Oracle WebCenter Content 12.2.1.4.0
- Oracle WebCenter Content 14.1.2.0.0
- Component: Content Server
Discovery Timeline
- 2026-06-17 - CVE-2026-35326 published to NVD
- 2026-06-17 - Last updated in NVD database
- Oracle Critical Patch Update - Addressed in the Oracle Security Alert (June 2026)
Technical Details for CVE-2026-35326
Vulnerability Analysis
The vulnerability resides in the Content Server component of Oracle WebCenter Content, an enterprise content management platform within Oracle Fusion Middleware. Per the Oracle advisory, the flaw is easily exploitable by an attacker with high privileges who can reach the application over HTTP. Successful exploitation results in full takeover of the WebCenter Content instance, including access to stored documents, metadata, and administrative functionality.
Because the impact spans confidentiality, integrity, and availability, an attacker who succeeds can read sensitive content, modify or delete managed documents, and disrupt content services consumed by downstream Fusion Middleware applications.
Root Cause
The issue is mapped to CWE-284: Improper Access Control. The Content Server component does not enforce sufficient authorization controls on certain operations, allowing a privileged authenticated user to perform actions beyond their intended scope. Oracle has not published low-level technical details, consistent with its standard advisory practice.
Attack Vector
The attack vector is network-based over HTTP. The attacker must already hold high-privileged credentials on the target WebCenter Content instance and does not require user interaction. The scope remains unchanged, but the attacker can pivot from a privileged application role to full control of the Content Server. No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
For technical details, refer to the Oracle Security Alert.
Detection Methods for CVE-2026-35326
Indicators of Compromise
- Unexpected administrative actions in WebCenter Content audit logs performed by accounts outside normal change windows.
- New or modified content profiles, security groups, or component definitions on the Content Server.
- Anomalous HTTP requests targeting privileged Content Server endpoints from unusual source IPs or user agents.
Detection Strategies
- Review WebCenter Content audit logs for privileged operations such as component installation, security group changes, and user role modifications.
- Correlate Oracle HTTP Server or WebLogic access logs with administrative actions to identify unauthorized sessions.
- Baseline normal administrator behavior and alert on deviations such as off-hours activity or new source addresses.
Monitoring Recommendations
- Forward WebCenter Content and WebLogic logs to a centralized SIEM for retention and correlation.
- Enable verbose auditing for administrative and content-management actions in the Content Server.
- Monitor authentication events for privileged WebCenter accounts and alert on anomalous logon patterns.
How to Mitigate CVE-2026-35326
Immediate Actions Required
- Apply the patches referenced in the Oracle Critical Patch Update Advisory - June 2026 to all affected WebCenter Content deployments.
- Inventory all Oracle WebCenter Content instances and confirm versions 12.2.1.4.0 and 14.1.2.0.0 are remediated.
- Audit privileged accounts on WebCenter Content and remove unnecessary high-privilege roles.
- Rotate credentials for administrative accounts after patching to invalidate any potentially exposed sessions.
Patch Information
Oracle addressed CVE-2026-35326 as part of its Critical Patch Update cycle. Patches are available through the Oracle Security Alert (June 2026). Customers should follow Oracle's documented patch application procedures for Fusion Middleware and validate the patch level after deployment.
Workarounds
- Restrict network access to the Content Server HTTP endpoints using firewall rules or reverse proxy access control lists until patches are applied.
- Limit the number of accounts granted administrative privileges on WebCenter Content to the minimum required.
- Enforce multi-factor authentication on accounts with administrative roles on Fusion Middleware components.
- Place WebCenter Content behind a web application firewall configured to log and inspect administrative request paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
