This vulnerability affects Oracle WebCenter Enterprise Capture, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It requires an attacker to have physical access to the communication segment attached to the hardware where the software runs and also requires human interaction from a person other than the attacker. The vulnerability can lead to a complete compromise of Oracle WebCenter Enterprise Capture and may affect additional Oracle products due to scope change. The CVSS 3.1 vector indicates attack vector as adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), required user interaction (UI:R), scope changed (S:C), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has released patches for this vulnerability as part of its September 2026 Critical Security Patch Update.

Successful exploitation can result in full takeover of Oracle WebCenter Enterprise Capture, with high impacts on confidentiality, integrity, and availability. The attack requires physical access to the communication segment and human interaction, limiting exploitability. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond WebCenter Enterprise Capture.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. The vulnerability requires physical access and user interaction, so limiting physical access to hardware and educating users may reduce risk but do not replace patching. Patch status is confirmed by the vendor advisory; therefore, applying the official patches is the recommended remediation.