This vulnerability exists in the Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically in the Client Bundle. It is exploitable remotely over the network via HTTP by an attacker with high privileges and requires user interaction from a third party. The vulnerability results in a scope change, potentially affecting additional Oracle products beyond WebCenter Enterprise Capture. The impact includes unauthorized creation, deletion, or modification of critical data, leading to high confidentiality and integrity impacts. The CVSS vector is AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and high confidentiality and integrity impact with no availability impact. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Enterprise Capture. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle WebCenter Enterprise Capture, resulting in a significant confidentiality and integrity breach. The scope change means that other Oracle products may also be impacted by successful exploitation. The vulnerability requires a high privileged attacker with network access and user interaction from a third party, which somewhat limits the attack vector but does not eliminate the risk. There is no reported impact on availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patches.