Description
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture allows an unauthenticated attacker with network access to exploit the Java RMI interface. Successful exploitation can lead to takeover of the WebCenter Enterprise Capture instance, compromising the confidentiality, integrity, and availability of the application and its data.

Affected Systems

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The vulnerability is confined to the Client Bundle module of this product.

Risk and Exploitability

The CVSS 3.1 base score of 9.8 indicates critical severity. The EPSS score of < 1% (specifically 0.00486) indicates a very low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote over the network via RMI, requiring no authentication, which still requires vigilance in environments exposed to external networks.

Generated by OpenCVE AI on August 21, 2026 at 13:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle-released patch that removes the RMI authentication flaw in WebCenter Enterprise Capture.
  • Configure the RMI service to require authentication and restrict connections to trusted IP ranges or hosts.
  • Enforce network perimeter controls by blocking inbound RMI traffic to the WebCenter Enterprise Capture host unless explicitly required.

Generated by OpenCVE AI on August 21, 2026 at 13:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated RMI-Based Remote Code Execution in Oracle WebCenter Enterprise Capture

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Enterprise Capture
CPEs cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_enterprise_capture:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Enterprise Capture
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Enterprise Capture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-21T03:56:53.163Z

Reserved: 2026-07-08T15:51:55.603Z

Link: CVE-2026-60946

cve-icon Vulnrichment

Updated: 2026-08-20T19:30:24.493Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:16:48.440

Modified: 2026-08-21T15:26:35.943

Link: CVE-2026-60946

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T14:00:13Z

Weaknesses