CVE-2026-35315: Oracle WebCenter Content Remote Takeover via Low-Privilege HTTP Access

Technical summary

CVE-2026-35315 is a privilege-escalation vulnerability in Oracle WebCenter Content's Content Server component. The flaw is classified under CWE-284 (Improper Access Control) and stems from insufficient validation or enforcement of access boundaries. With a CVSS 3.1 score of 8.8, the vulnerability requires low-level privileges and network access via HTTP, but no user interaction. Once exploited, an attacker achieves complete system compromise, affecting all three security pillars: confidentiality (reading sensitive content), integrity (modifying or injecting content), and availability (disrupting or disabling the service).

Business impact

WebCenter Content often serves as the central repository for enterprise documents, policies, and sensitive intellectual property. Compromise of this system exposes all stored content to unauthorized access and modification. An attacker could exfiltrate confidential business documents, tamper with critical records, or render the content repository unavailable, disrupting document workflows and compliance processes. For regulated industries, this creates immediate data breach and audit risks.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed vulnerable. These are relatively recent builds within their respective release families (12.2.x and 14.1.x). Organizations running earlier or later patch versions should verify their specific build number against Oracle's advisory to confirm exposure.

Exploitability

The vulnerability is rated 'easily exploitable' because it requires only low-level authentication (a standard user account) and network access—no sophisticated techniques, special conditions, or user interaction needed. Any user with valid credentials to the WebCenter Content system can potentially trigger the flaw. In environments where accounts are shared or credentials are leaked, this dramatically increases risk.

Remediation

Apply the security patches provided by Oracle for affected versions. Oracle typically releases patches through its regular quarterly Critical Patch Update (CPU) cycle. Users must download and apply the relevant patch for their specific version (12.2.1.4.0 or 14.1.2.0.0) and test in a staging environment before production deployment. If patches are unavailable, restrict network access to WebCenter Content using firewall rules or network segmentation to limit exposure to trusted hosts.

Patch guidance

Contact Oracle for the specific patch version applicable to your WebCenter Content release. Patch availability and timing should be confirmed through Oracle's security advisory portal. Before applying patches to production, validate in a test environment to ensure compatibility with custom extensions or integrations. Plan patching during a maintenance window to minimize disruption. Verify patch application by confirming the updated version string and re-testing the vulnerability condition.

Detection guidance

Monitor access logs for unusual authentication patterns, especially repeated login attempts from unexpected sources or privilege escalation activities. Check for POST/PUT requests to sensitive content management endpoints from low-privilege accounts. Deploy Web Application Firewalls (WAF) configured to detect tampering or access control bypass attempts against WebCenter Content. Network intrusion detection systems should be tuned to flag anomalous HTTP traffic to the Content Server. Consider implementing enhanced logging and alerting around content modifications and access to sensitive repositories.

Why prioritize this

This vulnerability scores 8.8 (HIGH severity) and should be treated as urgent. It requires only low-level credentials and network access, making it highly exploitable in most enterprise environments where WebCenter Content is deployed. The impact scope covers all three security properties (confidentiality, integrity, availability), and compromise results in full system takeover. Even though it is not yet listed on the CISA KEV catalog, the combination of ease of exploitation and business-critical role of the affected system demands rapid patching.

Risk score, explained

The CVSS 3.1 base score of 8.8 reflects: (1) network-based attack vector requiring no special positioning; (2) low complexity—no race conditions or special setup; (3) low privilege requirement—standard user credentials suffice; (4) no user interaction needed; and (5) complete compromise across all impact categories (confidentiality, integrity, availability). The score does not account for business context (centrality of content repository) or environmental factors (pervasiveness of WebCenter Content in enterprises), which may warrant even higher prioritization.

Frequently asked questions