This vulnerability exists in the Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware (Client Bundle). It is easily exploitable by an attacker with low privileges and network access via T3 or IIOP protocols. Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability in the provided content.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle WebCenter Enterprise Capture, resulting in complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability also has potential to impact additional Oracle products due to scope change.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to T3 and IIOP services to trusted users only.