This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise and potential takeover of the product. The vulnerability has a critical CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this specific CVE. The advisory emphasizes the importance of applying patches promptly but does not provide a direct remediation status for this vulnerability.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. Additionally, the vulnerability's scope change may allow impact on other Oracle products integrated or dependent on this component. The critical CVSS score (9.9) reflects the severity and ease of exploitation with network access and low privileges.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until an official patch is confirmed and applied, restrict network access to Oracle WebCenter Enterprise Capture and monitor for suspicious activity related to this product.