This vulnerability exists in the Client Bundle component of Oracle WebCenter Enterprise Capture within Oracle Fusion Middleware. It is exploitable remotely over the network with low privileges and no user interaction, leveraging T3 and IIOP protocols. The vulnerability allows an attacker to fully compromise the Oracle WebCenter Enterprise Capture product, with potential collateral impact on other Oracle products. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vendor advisory is part of the July 2026 Critical Patch Update but does not explicitly state a patch for this specific vulnerability, so patch status is not confirmed.

Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. The vulnerability is easily exploitable by a low privileged attacker with network access, increasing the risk of compromise. Additionally, the attack may have a scope change impact affecting other Oracle products beyond WebCenter Enterprise Capture.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to T3 and IIOP services where possible to reduce exposure.