This vulnerability affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It is difficult to exploit and requires a low privileged attacker to have logon access to the infrastructure where the product runs, as well as human interaction from a person other than the attacker. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data and full access to all data accessible by the product. The scope of impact may extend to additional Oracle products. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, with a base score of 7.2. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability, and customers are strongly advised to apply these patches promptly.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Enterprise Capture, as well as unauthorized access to all data accessible by the product. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires low privileges and user interaction, and successful exploitation may affect additional Oracle products due to scope change.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security updates to mitigate this and other vulnerabilities. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.