This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via T3 and IIOP protocols by an attacker with low privileges, without user interaction. The vulnerability allows complete compromise of the affected product and may have broader impact on other Oracle products (scope change). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches immediately to mitigate the risk. Workarounds include blocking network protocols used in exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation results in full compromise of Oracle WebCenter Enterprise Capture, including takeover of the product. The vulnerability impacts confidentiality, integrity, and availability at a high level. Additionally, the scope of impact may extend to other Oracle products due to the interconnected nature of the affected component. This could lead to significant operational and security risks if exploited.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches without delay to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols T3 and IIOP that are required for exploitation, and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. However, these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches promptly.