This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable by a low privileged attacker with network access through SOAP, enabling unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability may also impact additional Oracle products due to scope change. Oracle has released patches as part of their September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle WebCenter Enterprise Capture. It also allows unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but not availability. The scope change means that other Oracle products may be impacted indirectly.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No indication of alternative mitigations or workarounds is provided in the advisory.