CVE-2026-35325: Oracle WebCenter Content Privilege Escalation (CVSS 8.8)

Technical summary

This vulnerability stems from an improper access control flaw (CWE-284) in Oracle WebCenter Content's Content Server component. The attack vector is network-based with low attack complexity and low privilege requirements—meaning an authenticated user without administrative credentials can trigger it. The impact spans all three confidentiality, integrity, and availability dimensions, indicating the attacker can read, modify, and delete data or disrupt service availability after successful exploitation. The CVSS 3.1 score of 8.8 reflects the high severity due to the combination of low barrier to entry and full system compromise capability.

Business impact

Successful exploitation allows attackers to take complete control of Oracle WebCenter Content, enabling them to access, modify, or exfiltrate sensitive documents and metadata stored within the system. For organizations relying on WebCenter Content for regulated document management, compliance workflows, or collaborative document sharing, this vulnerability poses a direct risk to data governance, audit trails, and regulatory compliance posture. Business continuity may be disrupted through denial-of-service attacks or destructive modifications to critical content repositories.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are directly impacted. Organizations running these specific patch levels on Oracle Fusion Middleware should assess their deployment scope immediately. Verify your installed version through Oracle Enterprise Manager or by checking the version information in the WebCenter Content administration console. Versions outside this range should be validated against the official Oracle security advisory to confirm whether they are affected.

Exploitability

This vulnerability is rated as easily exploitable because it requires only network access and a low-privilege user account—both commonly available in enterprise environments. No zero-click or user-interaction requirements exist; an attacker with valid credentials can launch an attack directly. The low attack complexity means no special conditions or timing windows are necessary. However, the requirement for at least one valid user account provides a modest baseline control; the vulnerability is not exploitable by anonymous attackers.

Remediation

Organizations must apply Oracle's security patches for the affected versions as soon as operationally feasible. Consult Oracle's official security advisory for specific patch version numbers and upgrade paths. In parallel, enforce network segmentation to restrict HTTP access to WebCenter Content to only trusted internal networks and authorized administrators. Implement strong access controls to limit user account creation and privilege escalation, and monitor Content Server logs for unusual access patterns or unauthorized modifications.

Patch guidance

Check the Oracle Critical Patch Update (CPU) or Security Advisory corresponding to CVE-2026-35325 for the exact patched versions applicable to your release line (12.2.1.x or 14.1.2.x). Oracle typically provides patches within CPU cycles; verify the patch date and applicability before deployment. Test patches in a non-production environment first to ensure compatibility with custom extensions or dependent applications. After patching, verify the Content Server version through the administrative interface to confirm successful application.

Detection guidance

Monitor WebCenter Content audit and HTTP access logs for signs of privilege escalation attempts or unusual content access by low-privileged accounts. Look for API calls or HTTP requests that modify system settings, create administrative users, or access restricted document folders from unexpected source IPs or user sessions. Implement intrusion detection rules that flag suspicious Content Server API activity from authenticated but non-administrative users. Regular log review and correlation with identity management events can help identify exploitation attempts before full compromise occurs.

Why prioritize this

This vulnerability merits urgent prioritization because it combines ease of exploitation (low privilege requirement, network-accessible), high severity (full system compromise), and impact on data confidentiality and integrity. Unlike many web vulnerabilities that require social engineering or zero-click vectors, this one only needs valid credentials—widely distributed in enterprise environments. Organizations using WebCenter Content for business-critical document management should treat patching as a critical priority within their change windows.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a vulnerability that is easily exploitable by authenticated users over the network with no interaction required, leading to complete compromise of system confidentiality, integrity, and availability. The score does not include external exploitation factors (e.g., ransomware campaigns or active exploitation) but represents the intrinsic technical severity. Organizations should consider context-specific risk factors: the number of WebCenter Content users, the sensitivity of content stored, and whether the system is internet-facing versus internal-only.

Frequently asked questions