This vulnerability affects the Oracle WebCenter Enterprise Capture product within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability also has a scope change impact, potentially affecting additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized access to all data accessible by Oracle WebCenter Enterprise Capture and unauthorized modification (update, insert, delete) of some of that data. The confidentiality impact is high, and the integrity impact is low. There is no impact on availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond WebCenter Enterprise Capture.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Affected customers should apply the relevant patches for Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. Patch status is confirmed by the vendor advisory.