CVE-2026-35317 Oracle WebCenter Content Authentication Bypass Vulnerability

Technical summary

CVE-2026-35317 is an improper permissions validation flaw (CWE-284) in Oracle WebCenter Content's Content Server component. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. It requires a low-privileged authenticated attacker with network access over HTTP. The attack vector is straightforward: low attack complexity, no user interaction required, and impact is not confined to the attacker's own context. With a CVSS 3.1 score of 8.8 (HIGH), all three impact categories—confidentiality, integrity, and availability—are fully compromised.

Business impact

Organizations using WebCenter Content for document management, collaboration, or records retention face severe operational and compliance risk. Exploitation grants attackers the ability to steal proprietary documents, alter or destroy business records, and interrupt content services. For regulated industries (financial, healthcare, legal), unauthorized access and modification of stored content may trigger breach notification obligations and regulatory penalties. The vulnerability's ease of exploitation combined with high impact makes it a critical priority for any WebCenter Content deployment in production.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 (long-term support branch) and 14.1.2.0.0 (current branch) are vulnerable. Any WebCenter Content deployment—whether standalone or integrated with Oracle Fusion Applications—is affected. The vulnerability is not limited to specific deployment architectures; on-premises and cloud-hosted instances are equally at risk if running these versions.

Exploitability

This vulnerability is easily exploitable. An attacker already holding valid credentials (employee, contractor, or compromised account) can mount the attack without additional tools, user interaction, or timing windows. The attack succeeds over standard HTTP network paths with no requirement for administrator privileges. The low barrier to exploitation means that any user account—even those with minimal assigned permissions—can potentially escalate to full system compromise. This significantly elevates risk in environments with weak account management or insider threat concerns.

Remediation

Apply the security patch released by Oracle for this vulnerability immediately upon release or verification. Verify the patched version number against Oracle's official advisory. Until patching is feasible, implement network-level access controls to restrict HTTP access to WebCenter Content to trusted networks and IP ranges, and enforce multi-factor authentication for all user accounts. Review and enforce least-privilege access policies to minimize the number of users with unnecessary permissions.

Patch guidance

Monitor Oracle's official security advisories and Critical Patch Update (CPU) schedules for the patch availability. Verify the exact patched version numbers directly from Oracle's announcement before deployment. Test patches in a staging environment that mirrors production configuration (integrations, custom extensions, third-party modules) to ensure compatibility. Plan the rollout during a maintenance window, as patching may require service restart. For organizations on extended support (version 12.2.1.4.0), confirm patch availability against your support contract; some older versions may not receive timely patches.

Detection guidance

Monitor WebCenter Content audit logs for suspicious low-privileged account activity, particularly operations performed by users outside their normal role scope (e.g., a read-only user exporting or modifying content). Watch for unusual bulk data access, permission modifications, or administrative actions initiated by non-administrative accounts. Network intrusion detection should flag HTTP requests to WebCenter Content endpoints from unexpected internal or external sources. Log aggregation tools should flag authentication followed immediately by high-privilege operations in the same session.

Why prioritize this

The combination of ease of exploitation, high impact across all security dimensions, and the fact that only low-privilege credentials are required places this vulnerability in the immediate-action tier. Organizations cannot mitigate through perimeter defense alone; defense-in-depth within the application is mandatory. Given that WebCenter Content often stores business-critical and sensitive documents, the data exposure and integrity risk are substantial.

Risk score, explained

The CVSS 3.1 HIGH score of 8.8 reflects: low attack complexity and no user interaction required (high exploitability); low privilege requirements (any authenticated user); direct network access without special tools; and complete compromise of confidentiality, integrity, and availability. The score appropriately captures that this is not a theoretical or edge-case vulnerability—it is a straightforward, reliable attack that a motivated insider or low-privileged account holder can execute immediately.

Frequently asked questions