CVE-2026-35281 is a critical security vulnerability in Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low privileged attacker with network access via T3 and IIOP protocols to compromise the product, potentially resulting in full takeover. The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. The CVSS 3.1 score of 9.9 reflects critical impact on confidentiality, integrity, and availability. Oracle has included fixes for this vulnerability in its June 2026 Critical Security Patch Update. The vendor advisory strongly urges customers to apply these patches immediately to prevent exploitation. Workarounds include blocking network protocols used in attacks and restricting privileges, but these may affect application functionality.

Successful exploitation of CVE-2026-35281 can lead to complete compromise of Oracle WebCenter Enterprise Capture, including full takeover of the product. The vulnerability impacts confidentiality, integrity, and availability at a critical level. Additionally, the scope change indicates that other Oracle products may also be significantly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-35281. Customers are strongly advised to apply the security patches without delay to mitigate this critical vulnerability. Until patches are applied, risk can be partially reduced by blocking network protocols (T3, IIOP) required for exploitation and by removing unnecessary privileges from users. However, these mitigations may disrupt normal application functionality. Oracle recommends remaining on actively supported versions and promptly applying all relevant patches as the primary mitigation.