Description
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Oracle WebCenter Enterprise Capture client bundle allows an attacker with low privileges and network reachability via the T3 or IIOP protocols to gain unauthorized remote execution on the application. The weakness stems from insufficient access control, enabling attackers to bypass authentication and take control of the system, thereby exposing confidentiality, integrity, and availability of the application.

Affected Systems

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are affected.

Risk and Exploitability

The CVSS base score of 9.9 indicates a critical level of severity. The EPSS score of less than 1 % suggests that exploitation is uncommon at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the potential for full takeover makes it a high‑risk target for adversaries that can reach the T3 and IIOP services over the network.

Generated by OpenCVE AI on August 4, 2026 at 03:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Oracle WebCenter Enterprise Capture to the security patch released in the CPU July 2026 update to address the client bundle flaw.
  • Restrict inbound traffic on the T3 and IIOP ports to trusted administrative IP addresses or subnets only.
  • Deploy log monitoring and alerting for anomalous T3 and IIOP activity to detect potential exploitation attempts.

Generated by OpenCVE AI on August 4, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover via Client Bundle Access Control Flaw in Oracle WebCenter Enterprise Capture

Thu, 30 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Remote Takeover via Client Bundle Access Control Flaw in Oracle WebCenter Enterprise Capture

Mon, 27 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Exploit Enables Compromise of Oracle WebCenter Enterprise Capture
Weaknesses CWE-269
CWE-284

Fri, 24 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306

Fri, 24 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Exploit Enables Compromise of Oracle WebCenter Enterprise Capture
Weaknesses CWE-269
CWE-284

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Enterprise Capture
CPEs cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_enterprise_capture:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Enterprise Capture
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Enterprise Capture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T20:04:04.920Z

Reserved: 2026-07-08T15:51:40.538Z

Link: CVE-2026-60458

cve-icon Vulnrichment

Updated: 2026-07-24T14:32:54.853Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T04:00:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function