This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP, allowing compromise of the product and potential full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply all relevant security patches from Oracle's Critical Patch Updates without delay.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability but strongly recommends applying Oracle Critical Patch Updates promptly. Organizations should monitor Oracle's official security alerts and apply all relevant patches from the July 2026 Critical Patch Update and subsequent updates as soon as they become available. Until patches are applied, restrict network access to Oracle WebCenter Enterprise Capture to trusted users only and consider additional network-level protections.