The weakness is in the client bundle component of Oracle WebCenter Enterprise Capture. It is a privilege‑on‑us weakness (CWE‑284) that can be triggered by an attacker with low privileges who has network connectivity to the web interface. When successfully exploited the flaw allows code to execute with the permissions of the application, resulting in a complete takeover of the affected instance. The impact includes full compromise of confidentiality, integrity, and availability of the Capture service.

The vulnerability affects Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0. Reports indicate that exploitation may extend to other components within a WebCenter deployment because of a change in scope of the affected software.

The CVSS v3.1 base score of 9.9 underscores the high severity. The EPSS score is below 1 % and the issue is not listed in CISA KEV, suggesting that exploitation attempts are rare but the vulnerability is considered easily exploitable. The attack vector is inferred to be over the network via HTTP to the client bundle, requiring only low privileges and no user interaction. Because the flaw can change scope, successful compromise could also impact ancillary WebCenter products deployed alongside Capture.