This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable remotely without authentication via RMI, allowing attackers to take over the product. The scope of impact extends beyond this product to other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a network attack vector with low complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability with scope change. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches immediately. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt normal operations.

Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, with full loss of confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication, increasing risk. The attack can also affect additional Oracle products due to scope change. This represents a critical security risk to affected environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the official patches from this update without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack (such as RMI) or by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle strongly advises remaining on actively supported versions and applying security patches promptly.