This vulnerability affects Oracle WebCenter Enterprise Capture component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over HTTP by an attacker with low privileges, allowing unauthorized access to sensitive data within the product. The vulnerability has a CVSS 3.1 score of 7.7, indicating a high confidentiality impact and a scope change that may affect other Oracle products. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across various Oracle products. Customers are strongly advised to apply the patches promptly to mitigate the risk.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle WebCenter Enterprise Capture. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of the vulnerability extends beyond Oracle WebCenter Enterprise Capture, potentially impacting additional Oracle products.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Customers should apply the official patches from Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or temporary fixes are indicated in the advisory.