This vulnerability affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 and allows an unauthenticated attacker with network access via RMI to compromise the product. The vulnerability is easily exploitable and can result in complete takeover of the affected product. The CVSS 3.1 score is 10.0 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability with scope change. Oracle’s Critical Security Patch Update advisory for June 2026 includes this vulnerability among 245 security patches. While the advisory strongly recommends applying the patches promptly, no explicit patch version or remediation level is provided in the input data. Oracle suggests blocking attack-related network protocols and removing unnecessary privileges as potential mitigations until patches are applied.

Successful exploitation allows an unauthenticated attacker with network access to completely compromise Oracle WebCenter Enterprise Capture, resulting in full takeover of the product. The vulnerability impacts confidentiality, integrity, and availability, and may also affect additional Oracle products due to scope change. This represents a critical risk to affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users. These mitigations may impact application functionality. Patch status is not explicitly confirmed in the advisory content provided; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.