CVE-2026-46782: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. in Oracle Corporation Oracle WebCenter Enterprise Capture
CVE-2026-46782 is a critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.9. Attacks exploiting this flaw may also affect additional Oracle products. Oracle has published a Critical Security Patch Update advisory recommending prompt patching and mitigation measures to reduce risk until patches are applied.
AI Analysis
Technical Summary
This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise and potential takeover of the product. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches promptly. Until patches are applied, risk can be reduced by blocking required network protocols and restricting privileges, though these mitigations may affect functionality. No explicit patch availability or fixed versions are stated in the advisory for this specific vulnerability, so customers must consult Oracle's advisory for current patch status.
Potential Impact
Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Enterprise Capture, resulting in complete loss of confidentiality, integrity, and availability of the product. The vulnerability's scope may extend to additional Oracle products, increasing potential impact. The CVSS 3.1 score of 9.9 reflects critical severity with network attack vector, low attack complexity, no user interaction, and scope change.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users who do not require them. These mitigations may disrupt application functionality. Customers should monitor Oracle's advisory at https://www.oracle.com/security-alerts/cspujun2026.html for patch availability and installation instructions. Patch status for this vulnerability is not explicitly confirmed in the advisory; therefore, customers must verify current remediation guidance from Oracle.
CVE-2026-46782: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. in Oracle Corporation Oracle WebCenter Enterprise Capture
Description
CVE-2026-46782 is a critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.9. Attacks exploiting this flaw may also affect additional Oracle products. Oracle has published a Critical Security Patch Update advisory recommending prompt patching and mitigation measures to reduce risk until patches are applied.
CVSS v3.1
Score 9.9critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise and potential takeover of the product. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches promptly. Until patches are applied, risk can be reduced by blocking required network protocols and restricting privileges, though these mitigations may affect functionality. No explicit patch availability or fixed versions are stated in the advisory for this specific vulnerability, so customers must consult Oracle's advisory for current patch status.
Potential Impact
Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Enterprise Capture, resulting in complete loss of confidentiality, integrity, and availability of the product. The vulnerability's scope may extend to additional Oracle products, increasing potential impact. The CVSS 3.1 score of 9.9 reflects critical severity with network attack vector, low attack complexity, no user interaction, and scope change.
Mitigation Recommendations
Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users who do not require them. These mitigations may disrupt application functionality. Customers should monitor Oracle's advisory at https://www.oracle.com/security-alerts/cspujun2026.html for patch availability and installation instructions. Patch status for this vulnerability is not explicitly confirmed in the advisory; therefore, customers must verify current remediation guidance from Oracle.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.297Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b60a0b89be68882657ff
Added to database: 06/16/2026, 20:46:02 UTC
Last enriched: 06/24/2026, 16:25:54 UTC
Last updated: 08/01/2026, 07:18:00 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.