CVE-2026-35327: Oracle WebCenter Content Auth Bypass Flaw

CVE-2026-35327 Overview

CVE-2026-35327 is a high-severity vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware, specifically in the Content Server component. The flaw stems from improper access control [CWE-284] and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTPS can exploit this vulnerability when a victim performs a required interaction. Successful exploitation enables unauthorized access to critical data and can also allow unauthorized update, insert, or delete operations on a subset of Oracle WebCenter Content data. The scope-change characteristic means impact can extend to additional products beyond WebCenter Content.

Critical Impact
Authenticated attackers can compromise Oracle WebCenter Content over the network with user interaction, gaining read access to all accessible data and limited write access, with cross-product impact due to a scope change.

Affected Products

Oracle WebCenter Content 12.2.1.4.0
Oracle WebCenter Content 14.1.2.0.0
Oracle Fusion Middleware — Content Server component

Discovery Timeline

2026-06-17 - CVE-2026-35327 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Addressed in the Oracle Security Alert June 2026

Technical Details for CVE-2026-35327

Vulnerability Analysis

The vulnerability resides in the Oracle WebCenter Content Content Server component. It is categorized as an improper access control issue [CWE-284]. An attacker authenticated with low privileges can reach the vulnerable functionality over HTTPS. Exploitation requires a separate user to perform an action initiated by the attacker, indicating a user-interaction-dependent attack pattern such as following a crafted link or processing attacker-supplied content.

Because the vulnerable component executes with elevated authority relative to the attacker session, successful exploitation crosses a security boundary. This scope change allows impact to extend to resources managed outside Oracle WebCenter Content itself. The confidentiality impact is high, exposing all data accessible to Content Server, while integrity impact is limited to a subset of records. Availability is not affected.

The EPSS score is 0.261% with a percentile of 17.246, indicating low current probability of in-the-wild exploitation. No public proof-of-concept or active exploitation has been reported at the time of publication.

Root Cause

The root cause is improper access control within Content Server request handling. The component fails to adequately restrict actions invoked by low-privileged sessions, permitting cross-boundary operations that affect data and other integrated products.

Attack Vector

The attack vector is network-based over HTTPS. The attacker must possess valid low-privileged credentials and must induce another user to interact with a crafted request, response, or resource. Refer to the Oracle Security Alert June 2026 for vendor-specific exploitation context.

No verified public exploit code is available for this issue. The vulnerability mechanism is described in prose because no sanitized exploitation sample has been published by the vendor or researchers.

Detection Methods for CVE-2026-35327

Indicators of Compromise

Unexpected access to WebCenter Content documents or folders by low-privileged user accounts outside their normal scope.
HTTPS requests to Content Server endpoints originating from authenticated sessions that include unusual parameter sets or unexpected referrers from external sites.
Audit log entries showing data modifications (insert, update, delete) by accounts that historically performed read-only operations.
Outbound activity or cross-product API calls triggered by Content Server sessions, consistent with the scope-change behavior of this issue.

Detection Strategies

Enable Content Server detailed audit logging and forward logs to a centralized SIEM for correlation across WebCenter Content and integrated Fusion Middleware products.
Baseline normal access patterns per user role and alert on deviations, particularly bulk reads or modifications by low-privileged accounts.
Inspect web access logs for crafted URLs targeting Content Server endpoints delivered through phishing or embedded links, given the user-interaction requirement.

Monitoring Recommendations

Monitor authentication events for low-privileged accounts that subsequently trigger high-volume data access in Content Server.
Track configuration and permission changes on WebCenter Content repositories and roles in near real time.
Correlate Content Server activity with downstream Fusion Middleware components to identify cross-product impact resulting from the scope change.

How to Mitigate CVE-2026-35327

Immediate Actions Required

Apply the patches delivered in the Oracle Security Alert June 2026 to Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all WebCenter Content instances, including non-production environments, and prioritize internet-facing systems for patching.
Review WebCenter Content user accounts and revoke unnecessary low-privileged access that could be leveraged as a foothold.
Educate users with Content Server access on the risks of following untrusted links, since exploitation requires victim interaction.

Patch Information

Oracle published fixes as part of the June 2026 Security Alert. Administrators should follow Oracle's standard Critical Patch Update procedures and apply the patch bundle for the affected Fusion Middleware versions. Patch metadata, download links, and platform-specific instructions are available in the Oracle Security Alert June 2026.

Workarounds

Restrict network access to Content Server endpoints using firewall rules, reverse proxy allowlists, or VPN-only access until patches are applied.
Enforce stricter role-based access controls and remove write permissions from accounts that do not require them.
Configure web application firewall rules to inspect and block suspicious HTTPS requests to Content Server URLs.
Disable or limit functionality that processes user-supplied content where feasible, reducing the surface for interaction-based exploitation.

bash

# Example: restrict access to Oracle WebCenter Content to trusted networks
# (iptables example - adapt for your environment)
iptables -A INPUT -p tcp --dport 16200 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 16200 -j DROP