This vulnerability affects the Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via T3 and IIOP protocols to exploit the system easily, leading to complete compromise of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the attack can be performed remotely with low complexity, resulting in high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state that a patch is available for these specific versions. The advisory strongly recommends applying patches promptly when available.

Successful exploitation of this vulnerability can lead to full takeover of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. An unauthenticated attacker can remotely execute this attack via network protocols T3 and IIOP without any user interaction or privileges, making it highly critical.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for official patch releases and apply them promptly once available. Until patches are confirmed and applied, restrict network access to T3 and IIOP protocols to trusted sources only to reduce exposure.