This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the product and potential full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for these specific versions in the provided content.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm patch availability or remediation instructions for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Security professionals should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch status and apply any available updates promptly. Until patches are confirmed and applied, restrict network access to Oracle WebCenter Enterprise Capture instances to trusted users only and monitor for suspicious activity.