This vulnerability in Oracle WebCenter Enterprise Capture's Client Bundle component allows an attacker with low privileges and network access via T3 or IIOP to compromise the system. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. Successful exploitation can lead to complete takeover of the product and may impact other Oracle products (scope change). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation status for these versions. Customers are strongly advised to apply Oracle patches promptly as per the advisory.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Enterprise Capture, resulting in complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability also has potential to impact additional Oracle products beyond WebCenter Enterprise Capture due to scope change.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability as part of a large set of security patches. However, the advisory content provided does not explicitly confirm patch availability or remediation status for Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until patches are confirmed and applied, restrict network access to T3 and IIOP services to trusted users only.