This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via T3 and IIOP protocols by an attacker with low privileges and no user interaction. The vulnerability allows complete compromise of the affected product, with potential scope change impacting other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches immediately to prevent exploitation.

Successful exploitation results in full compromise of Oracle WebCenter Enterprise Capture, including confidentiality, integrity, and availability impacts. The vulnerability can be exploited remotely by a low privileged attacker with network access, potentially allowing takeover of the product. Additionally, the attack may have a scope change effect, significantly impacting other Oracle products integrated or dependent on WebCenter Enterprise Capture.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the official Oracle patches without delay to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation (T3, IIOP) and by removing unnecessary privileges or access to vulnerable packages from users who do not require them. However, these mitigations may disrupt application functionality. Oracle strongly recommends prioritizing patch application as the primary remediation.