CVE-2026-35327: Oracle WebCenter Content Broken Access Control (CVSS 7.6)

Technical summary

CVE-2026-35327 is a privilege escalation and broken access control vulnerability (CWE-284) in Oracle WebCenter Content's Content Server component. The attack vector is network-based over HTTPS and exploits the application's insufficient authorization checks. A low-privileged authenticated user can craft a request that, when combined with user interaction from a higher-privileged target, bypasses access restrictions. The scope is marked as changed, meaning successful exploitation impacts not only WebCenter Content itself but potentially other connected Oracle Fusion Middleware components. The CVSS 3.1 vector reflects low attack complexity, network accessibility, and high confidentiality impact with low integrity risk.

Business impact

Unauthorized disclosure of business-critical content repositories represents the primary risk—WebCenter Content typically stores contracts, employee records, financial documents, and proprietary information. An attacker gaining elevated access could exfiltrate sensitive data, modify audit trails, or corrupt document versions. The requirement for user interaction may limit the attack surface, but phishing or social engineering can reliably trigger the necessary action. Organizations using WebCenter Content for compliance-sensitive repositories (healthcare, finance, legal) face particular exposure.

Affected systems

Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected. Verify your deployment against these specific patch levels. Other versions and Oracle Fusion Middleware components connected to affected WebCenter instances may also be at risk due to the scope-change nature of the vulnerability. Third-party applications integrating with WebCenter Content APIs should be assessed for indirect exposure.

Exploitability

The vulnerability is easily exploitable from a technical perspective (low attack complexity, network access, low privilege requirement). However, the UI:R (User Interaction Required) constraint meaningfully reduces real-world ease of exploitation—the attacker cannot unilaterally trigger the vulnerability and must socially engineer a legitimate user. Targeted phishing campaigns against WebCenter Content users make this feasible for motivated threat actors. Public exploit code availability has not been confirmed; organizations should monitor vendor advisories and threat intelligence feeds.

Remediation

Apply Oracle's security patch for CVE-2026-35327 immediately upon availability—verify the exact patch version from Oracle's Critical Patch Update (CPU) advisory matching your current WebCenter Content release. If patching cannot be immediately deployed, implement network segmentation to restrict WebCenter Content access to known legitimate users and consider temporarily disabling external HTTPS access for non-critical use cases. Review and strengthen access control policies to enforce least-privilege access to sensitive content repositories.

Patch guidance

Monitor Oracle's official security advisory for the CVE-2026-35327 remediation patch. Oracle typically releases patches via its quarterly Critical Patch Update program. Prioritize patching production environments running the affected versions (12.2.1.4.0 and 14.1.2.0.0) within 30 days. Test patches in a staging environment that mirrors your production configuration, including any custom content types or integrations, before deployment. Plan for potential downtime and coordinate with business owners of dependent applications.

Detection guidance

Monitor WebCenter Content audit logs for suspicious access patterns: low-privileged users accessing high-classification documents, bulk data exports by non-admin accounts, or modification of content without corresponding user action logs. Look for HTTPS requests with unusual parameters or crafted authentication tokens. Implement network detection for anomalous content server queries. Correlate WebCenter Content logs with email and endpoint logs to identify phishing campaigns targeting users with access to sensitive repositories. Consider deploying a Web Application Firewall (WAF) rule set specific to Oracle WebCenter to flag exploitation attempts.

Why prioritize this

CVE-2026-35327 merits immediate prioritization due to its HIGH CVSS score (7.6), high confidentiality impact, and the sensitivity of data typically stored in WebCenter Content. Although user interaction is required, it is a realistic attack prerequisite rather than a prohibitive barrier. The scope-change designation means remediation or containment must account for downstream systems. Organizations managing compliance-sensitive or financially material information in WebCenter should treat patching as urgent.

Risk score, explained

The CVSS 7.6 HIGH rating reflects the combination of easily exploitable network accessibility, low barrier to entry (low privilege requirement), and severe confidentiality loss. The high C (confidentiality) and low I (integrity) ratings indicate that data disclosure is the primary concern, though unauthorized modification is also possible. The scope change signals that the impact may extend beyond the vulnerable component itself, elevating business risk. User interaction is factored in the vector but does not prevent a motivated attacker from triggering the flaw via social engineering.

Frequently asked questions