CVE-2026-35282

Executive Summary

CVE-2026-35282 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. The flaw resides in the Client Bundle component and is exploitable via T3 and IIOP protocols. A low-privileged attacker with network access can achieve full remote code execution, leading to complete compromise of the application. The vulnerability has a CVSS score of 9.9 due to its ease of exploitation, low privilege requirement, and potential for cascading attacks across other systems (scope change). No public proof-of-concept or patch is currently available, making network-level mitigations essential.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Oracle Java-based middleware component. Organizations should verify their software supply chain for affected versions and ensure no unauthorized third-party libraries are introduced.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – exploitation can impact resources beyond the vulnerable component.
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The low attack complexity and low privilege requirement make this highly attractive to threat actors. The scope change indicates potential lateral movement.

Deep Dive & Mechanics

The vulnerability is a Java deserialization flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture. The application uses T3 (a proprietary Oracle protocol) and IIOP (Internet Inter-ORB Protocol) for communication between clients and servers. These protocols handle serialized Java objects. An attacker can craft a malicious serialized object that, when deserialized by the server, triggers arbitrary code execution.

Root Cause: The application does not properly validate or sanitize incoming serialized data before deserialization. This allows an attacker to inject a gadget chain (e.g., using common libraries like Commons Collections or Spring) that executes system commands.

Attack Flow:

1. Attacker gains low-privileged access to the network (e.g., via compromised credentials or network access).
2. Attacker sends a crafted serialized payload over T3 or IIOP to the vulnerable service.
3. The server deserializes the payload, triggering the gadget chain.
4. The attacker achieves remote code execution with the privileges of the application server (typically a system or service account).
5. Due to scope change, the attacker can pivot to other systems.

Vulnerable vs. Patched Code

Since no official patch is available, the comparison is between vulnerable and mitigated configurations.

Vulnerable Configuration:

• Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 with T3 and IIOP protocols enabled.
• Default configuration allows deserialization of arbitrary objects.

Mitigated Configuration (Workaround):

• Disable T3 and IIOP protocols if not required.
• Implement network segmentation to restrict access to the service.
• Apply Oracle’s recommended security patches when available.

Code Snippet (Conceptual):

// Vulnerable: Direct deserialization without validation
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject(); // Unsafe

// Mitigated: Use a whitelist filter
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("!*;java.base/*;!*");
ois.setObjectInputFilter(filter);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Kali Linux or similar penetration testing distribution.
• Java Runtime Environment (JRE) 8 or later.
• ysoserial tool for generating deserialization payloads.
• Network access to the target Oracle WebCenter Enterprise Capture service on T3 (port 7001) or IIOP (port 7002).

Steps:

1. Identify the target service using Shodan or Nmap:

   nmap -p 7001,7002 --open -sV <target_ip>
   

2. Generate a deserialization payload using ysoserial:

   java -jar ysoserial.jar CommonsCollections1 'cmd /c whoami' > payload.bin
   

3. Send the payload over T3 using a custom script or tool like t3-poc:

   python3 t3_exploit.py <target_ip> 7001 payload.bin
   

4. Verify code execution by checking for a reverse shell or command output.

Note: No public exploit code is available for this specific CVE. The above is a generic approach for T3 deserialization.

Blue Team (Defensive)

Detection:

• Monitor network traffic for unusual T3/IIOP connections from unexpected sources.
• Enable logging on the application server for deserialization errors.
• Use intrusion detection systems (IDS) to detect known ysoserial gadget signatures.

Mitigation:

• Disable T3 and IIOP protocols in the WebLogic console:
  • Navigate to Domain > Environment > Servers > [Server Name] > Protocols.
  • Uncheck "Enable T3" and "Enable IIOP".
• Apply network access control lists (ACLs) to restrict access to ports 7001 and 7002.
• Implement a Web Application Firewall (WAF) with rules to block deserialization payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual T3/IIOP traffic on ports 7001 and 7002 from non-trusted IPs.
  • Large serialized objects in network packets.
  • Connections to known command-and-control (C2) servers after exploitation.

• Host IOCs:

  • Unexpected processes spawned by the Java application (e.g., cmd.exe, bash).
  • New files in the application directory (e.g., webshells, backdoors).
  • Unusual entries in application logs indicating deserialization errors.

• File IOCs:

  • Presence of ysoserial payload files (e.g., payload.bin).
  • Modified Java class files or JAR archives.

Detection Engineering

YARA Rule

rule CVE_2026_35282_Deserialization_Payload {
    meta:
        description = "Detects ysoserial payloads targeting Oracle WebCenter T3/IIOP deserialization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35282"
    strings:
        $gadget1 = "CommonsCollections" ascii wide nocase
        $gadget2 = "Spring" ascii wide nocase
        $gadget3 = "Jdk7u21" ascii wide nocase
        $t3_header = { 74 33 00 00 00 00 00 00 } // T3 protocol header
    condition:
        any of ($gadget*) and $t3_header
}

Sigma Rule

title: CVE-2026-35282 - Oracle WebCenter T3/IIOP Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of deserialization attacks against Oracle WebCenter Enterprise Capture via T3/IIOP
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port:
            - 7001
            - 7002
        protocol: tcp
        payload_length: '> 1000'  # Large serialized objects
    condition: selection
falsepositives:
    - Legitimate large data transfers
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 7001,7002 (msg:"CVE-2026-35282 - Oracle WebCenter T3/IIOP Deserialization Attempt"; flow:to_server,established; content:"|74 33 00 00 00 00 00 00|"; depth:8; content:"|ac ed 00 05|"; within:100; reference:cve,2026-35282; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable T3 and IIOP protocols on all affected servers if not required for business operations.
   • Restrict network access to ports 7001 and 7002 using firewalls or security groups.
   • Monitor for any signs of compromise using the provided IOCs and detection rules.

2. Long-term Fix:

   • Apply official patches from Oracle when released (monitor Oracle Critical Patch Updates).
   • Upgrade to a non-vulnerable version if available.
   • Implement Java deserialization filters (e.g., JEP-290) to whitelist allowed classes.

3. Compromise Assessment:

   • If exploitation is suspected, conduct a full forensic investigation.
   • Check for backdoors, webshells, and unauthorized user accounts.
   • Rotate all credentials and review system logs for lateral movement.

Valters IT
DevSecOps & Cyber Threat Intelligence
This report is provided for authorized security testing and defensive purposes only.