This vulnerability affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP, allowing compromise of the product and potential full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products but does not explicitly confirm patch availability or remediation status for this vulnerability. Customers are strongly advised to apply Oracle patches promptly as per the advisory.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected system, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. While the advisory does not explicitly confirm patch availability for CVE-2026-61099, customers should review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly. Maintaining actively supported versions and timely patch application is strongly recommended by Oracle. Patch status is not yet confirmed specifically for this vulnerability—check the vendor advisory for current remediation guidance.