CVE-2026-35324: Oracle WebCenter Content Authentication Bypass & System Takeover

Technical summary

CVE-2026-35324 is an improper access control vulnerability (CWE-284) in Oracle WebCenter Content's Content Server component. The flaw permits privilege escalation or lateral movement by authenticated attackers over the network. With only low-privilege credentials and HTTP connectivity, an attacker can bypass authorization controls and achieve complete compromise of the affected system. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability.

Business impact

Compromise of WebCenter Content deployments poses significant operational and legal risk. Organizations using affected versions face potential exposure of business-critical content, intellectual property, and customer data stored in the repository. The vulnerability enables unauthorized modification of records, which can compromise compliance posture and audit trails. Service disruption is also possible, affecting content distribution and collaboration workflows that many enterprises depend on for daily operations.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable. Organizations should inventory deployments of these specific minor versions and assess upgrade feasibility. Versions outside this list are not confirmed affected by this CVE, though Oracle's advisory should be consulted for the full scope of supported versions and upgrade paths.

Exploitability

The attack vector is rated as low complexity and requires only network access—no client-side tricks or special conditions. Critically, the attacker must already possess valid login credentials with low privilege level. This means internal threats, compromised contractor accounts, or credentials obtained through earlier breaches create immediate risk. Public exploit code has not been added to the KEV catalog as of the source data date, but the straightforward nature of the flaw (improper access control) suggests exploitation is practical.

Remediation

Apply security patches from Oracle immediately upon availability. Verify patch versions in Oracle's official security advisory. Organizations unable to patch urgently should implement network segmentation to restrict HTTP access to WebCenter Content to authorized internal users only. Review and audit access logs for suspicious activity by low-privilege users. Consider temporarily disabling non-essential accounts pending patch deployment.

Patch guidance

Consult Oracle's June 2026 Critical Patch Update (CPU) and official security advisory for verified patch versions for both 12.2.1.4.0 and 14.1.2.0.0 lineages. Test patches in a staging environment before production rollout. Prioritize patching of Internet-facing or multi-tenant instances. If your version is not listed in the advisory, verify with Oracle support whether an upgrade to a patched release is required.

Detection guidance

Monitor HTTP requests to WebCenter Content endpoints for unusual activity by low-privilege accounts, particularly operations that access, modify, or export content outside normal workflows. Search authentication and authorization logs for failed access attempts followed by successful operations at elevated effective privilege. Alert on API calls or web requests from low-privilege accounts that typically come from administrative roles. Implement integrity monitoring on the WebCenter Content repository to detect unauthorized file modifications.

Why prioritize this

A CVSS score of 8.8 (HIGH severity) combined with low attack complexity and the requirement for only network access and low-privilege credentials creates urgent risk. Many organizations have legacy or secondary WebCenter Content instances with broader internal access. Attackers with any valid login—whether employee, contractor, or from a prior breach—can immediately escalate to full system compromise. This vulnerability should be patched within days, not weeks.

Risk score, explained

The 8.8 CVSS reflects a near-maximum-impact scenario: full confidentiality, integrity, and availability compromise achievable by an attacker with minimal privileges and no special attack conditions. The primary limiting factor is the requirement for an existing valid account; the vulnerability does not grant initial access. However, in environments with shared credentials, weak password policies, or recent insider threats, this requirement poses minimal friction.

Frequently asked questions