This vulnerability exists in the Client Bundle component of Oracle WebCenter Enterprise Capture, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by attackers with low privileges who have network access via T3 or IIOP protocols. Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which addresses multiple vulnerabilities across Oracle products, but the advisory does not explicitly state patch availability or remediation details specific to this vulnerability.

Successful exploitation of this vulnerability can result in full takeover of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the affected system. Additionally, due to scope change, attacks may significantly impact other Oracle products beyond WebCenter Enterprise Capture.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to T3 and IIOP services to trusted users only.