This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via the T3 protocol to compromise the system, resulting in complete takeover of the product. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. The scope of impact extends beyond the affected product to other Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches. Oracle strongly recommends applying the update immediately. Workarounds include blocking network protocols used by the attack and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation allows an attacker with low privileges and network access via T3 to fully compromise Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability. The vulnerability’s scope change means additional Oracle products may also be affected indirectly. The CVSS 3.1 base score of 9.9 reflects critical severity.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply this patch promptly to remediate the issue. Until the patch is applied, risk can be partially mitigated by blocking network protocols required for exploitation (such as T3) and by removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.