This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the system. The scope of impact may extend beyond this product to other Oracle products. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, low confidentiality impact, high integrity impact, and low availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which contains targeted high-priority fixes.

The vulnerability allows unauthenticated remote attackers to compromise Oracle WebCenter Enterprise Capture, leading to unauthorized data creation, deletion, modification, unauthorized read access to some data, and partial denial of service. The impact affects confidentiality, integrity, and availability, with a critical severity rating (CVSS 3.1 score 9.9). The scope of the vulnerability extends potentially to other Oracle products due to shared components or integrations.

Oracle has released a security patch for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers should apply the patch promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated in the advisory.