CVE-2026-35322: Oracle WebCenter Content Privilege Escalation (CVSS 8.8)

Technical summary

CVE-2026-35322 is an improper access control vulnerability (CWE-284) in the Oracle WebCenter Content product, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged authenticated attacker to escalate privileges via HTTP network requests. The attack requires no user interaction and succeeds against the default security configuration. With a CVSS 3.1 score of 8.8 and a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the flaw carries high impact across all three security dimensions: an attacker gains the ability to read, modify, or delete protected content; manipulate system configuration; and disrupt service availability.

Business impact

Organizations relying on Oracle WebCenter Content for enterprise document management face significant operational and security risk. A successful exploit enables attackers to exfiltrate sensitive documents, modify compliance records, inject malicious content, or destroy data integrity. For regulated industries (finance, healthcare, legal), this can result in breach notification obligations, regulatory penalties, and loss of stakeholder trust. The vulnerability is particularly concerning because it requires only standard user credentials—meaning insider threats, compromised contractor accounts, or lateral movement from other breached systems can trigger full system compromise. Remediation delays increase exposure window and potential forensic complexity.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are directly impacted. Organizations should immediately inventory deployments of these specific builds. Verify exact patch levels in your environment, as intermediate versions between these releases may also be affected—consult Oracle's official advisory for the complete support matrix. Environments where WebCenter Content is internet-facing or accessible to remote workers carry elevated risk. Air-gapped or heavily network-segmented deployments have reduced but not eliminated exposure if internal actors possess valid credentials.

Exploitability

This vulnerability is easily exploitable from a technical standpoint: the attack vector is network-accessible (HTTP), the attack complexity is low, and no user interaction is required. The critical limiting factor is the attacker must already possess valid low-privileged user credentials. This significantly reduces opportunistic external exploitation but does not eliminate risk. Compromised employee accounts, overly-permissive service accounts, or credentials leaked through phishing campaigns are realistic attack prerequisites. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, but organizations should assume active research and eventual proof-of-concept development given the high CVSS score and ease of exploitation once initial access is obtained.

Remediation

Apply security patches from Oracle immediately upon availability. Oracle typically releases critical patches on its published Critical Patch Update (CPU) schedule or as out-of-band fixes. Until patches are deployed, implement strict network access controls: restrict HTTP access to WebCenter Content to trusted internal networks, disable remote access where operationally feasible, and enforce multi-factor authentication for all user accounts. Review and revoke unnecessary user privileges, particularly service accounts and administrative roles. Monitor access logs for anomalous activity, especially privilege escalation attempts and bulk content downloads. Isolate vulnerable instances from production workflows if patches cannot be applied within your maintenance window.

Patch guidance

Contact Oracle Support or consult the Oracle Security Alerts page for patch availability and version-specific guidance. Patches will be version-specific; do not assume a patch for 14.1.2.0.0 will apply to 12.2.1.4.0. Test patches in a non-production environment before production rollout to validate compatibility with custom extensions and dependent systems. Oracle typically provides patches through their Patch Cloud and My Oracle Support portal. Coordinate patching with change management processes and schedule maintenance windows with minimal business disruption. Verify patch application by confirming the patched version number and re-running vulnerability scans post-deployment.

Detection guidance

Monitor WebCenter Content HTTP access logs for privilege escalation attempts, particularly requests from low-privileged user accounts accessing administrative endpoints or APIs. Alert on unusual patterns: rapid API calls, access to sensitive system folders by non-administrative users, or changes to user role assignments initiated by accounts that should not have such permissions. Implement SIEM rules to flag any successful privilege changes. Review audit logs for creation or modification of system accounts outside of normal administrative procedures. Network-based detection should flag suspicious HTTP request patterns typical of privilege escalation probes. Test detection rules with authorized security teams before deploying to production monitoring.

Why prioritize this

Despite not yet appearing on CISA's KEV list, this vulnerability merits immediate prioritization due to its high CVSS score (8.8), ease of exploitation, and comprehensive impact (confidentiality, integrity, availability). The requirement for prior user credentials significantly limits spread but does not reduce severity—many organizations struggle with credential hygiene and segregation. WebCenter Content often stores business-critical documents and intellectual property, making compromise high-value for attackers. The affected versions are in active use in enterprises; older versions facing end-of-support may have longer remediation timelines, increasing risk accumulation. Organizations should treat this as equivalent to a zero-day until patches are validated in production.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the confluence of several factors: unrestricted network access (AV:N), low attack complexity (AC:L), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The requirement for low-level user privileges (PR:L) prevents the score from reaching critical (9.0+) but remains a substantial threat vector given common credential compromise scenarios. The lack of required user interaction (UI:N) means exploitation is deterministic once an attacker obtains valid credentials. No scope change (S:U) indicates the impact is confined to the vulnerable component, not adjacent systems—though in practice, compromised document repositories often serve as stepping stones for lateral movement.

Frequently asked questions