This vulnerability affects Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with high privileges and network access via HTTP, allowing compromise and potential takeover of the product. The vulnerability also has scope to impact additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability.

Successful exploitation can lead to complete compromise of Oracle WebCenter Enterprise Capture, including confidentiality, integrity, and availability impacts. The vulnerability's scope change means it may also affect other Oracle products integrated with or dependent on this component. This could result in unauthorized access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security updates. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.