This vulnerability affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation can lead to full compromise of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially impacting business operations and sensitive data handled by the software.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability but references the July 2026 Critical Patch Update. Oracle recommends that customers apply security patches promptly and remain on actively supported versions. Patch status is not yet confirmed for this specific vulnerability—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.