This vulnerability affects Oracle WebCenter Enterprise Capture in the Client Bundle component for versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via T3 and IIOP protocols by an attacker with low privileges, without requiring user interaction. Successful exploitation can lead to complete compromise of the affected product. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying the patch to supported versions to prevent exploitation.

The vulnerability allows an attacker with low privileges and network access to remotely compromise Oracle WebCenter Enterprise Capture, potentially resulting in full system takeover. This impacts confidentiality, integrity, and availability of the affected system, posing a significant risk to organizations using the affected versions.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the official security patches to affected versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the vendor advisory.