This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing full compromise of the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact is high across confidentiality, integrity, and availability. The vendor advisory references the July 2026 Oracle Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can result in complete takeover of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could allow attackers to execute arbitrary code, access sensitive data, and disrupt service operations.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle WebCenter Enterprise Capture instances to trusted users only.