This vulnerability affects the Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP, enabling compromise of the product and potential takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability as part of a broader set of 673 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in complete compromise of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Users should apply these official patches promptly to remediate the vulnerability. Oracle advises customers to remain on actively supported versions and to apply security patches without delay to prevent exploitation. No additional mitigation steps are specified beyond patch application.