This vulnerability affects Oracle WebCenter Enterprise Capture component Client Bundle in versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access over HTTP to exploit the flaw and compromise the system, potentially resulting in complete takeover of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and other vulnerabilities.

Successful exploitation can lead to full compromise of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially impacting business operations and sensitive data managed by the software.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends staying on actively supported versions and applying all relevant patches without delay. Patch status is confirmed as available via the vendor advisory.