This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction is required. Successful exploitation can lead to complete compromise of the affected product. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could result in unauthorized data access, modification, or disruption of service. No known exploits in the wild have been reported at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to mitigate exploitation risks.