CVE-2026-46779 affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable network vulnerability via the T3 protocol that allows a low privileged attacker to compromise the product, resulting in complete takeover. The vulnerability has a CVSS 3.1 score of 9.9 with critical impacts on confidentiality, integrity, and availability, and scope to affect other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches. While no explicit fixed versions are listed, Oracle strongly recommends applying the Critical Security Patch Update without delay. Workarounds such as blocking attack-related network protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt functionality.

Successful exploitation of CVE-2026-46779 can lead to full compromise of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. The vulnerability also has scope to affect additional Oracle products beyond WebCenter Enterprise Capture. This could result in unauthorized access, data breaches, and disruption of services dependent on the affected product.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (such as T3) and removing unnecessary privileges from users. However, these mitigations may impact application functionality. Customers should follow Oracle's official patch documentation and advisories for detailed remediation instructions.