This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable remote code execution vulnerability accessible via RMI without authentication, allowing attackers to take over the product. The vulnerability also has scope to impact additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this vulnerability among 245 others and strongly recommends applying patches promptly. While no explicit patch version is listed for this vulnerability, the advisory is the authoritative source for remediation status.

Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, with full confidentiality, integrity, and availability compromise. The vulnerability is remotely exploitable without authentication, increasing risk. Additionally, the attack may affect other Oracle products due to scope change. This represents a critical risk to affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for RMI access and by removing unnecessary privileges or access to relevant packages from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed for specific versions; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.