This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture and may affect other Oracle products due to scope change. The vulnerability carries a CVSS 3.1 score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability with scope change. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for these specific versions in the provided data. Oracle strongly recommends applying the Critical Security Patch Update to address this and other vulnerabilities.

Successful exploitation allows an attacker with low privileges and network access via HTTP to take over Oracle WebCenter Enterprise Capture. This can lead to complete compromise of the product, affecting confidentiality, integrity, and availability. Additionally, the vulnerability's scope change indicates potential impact on other Oracle products integrated or related to Oracle WebCenter Enterprise Capture.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. However, these mitigations may disrupt application functionality. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should verify current remediation guidance from Oracle.