Description
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in the Client Bundle component of Oracle WebCenter Enterprise Capture allows an attacker with low privileges and network access via HTTP to gain control over the application, potentially leading to full takeover. The flaw is high severity, with CVSS v3.1 Base Score 8.8, indicating significant confidentiality, integrity and availability impacts.

Affected Systems

Oracle Corporation’s WebCenter 12.2.1.4.0 and 14.1.2.0.0.

Risk and Exploitability

The CVSS vector indicates Attack Vector Network, Low Access Complexity, and Privileges Required Low, meaning exploitation is likely over the web. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog; however, the high severity and network reach make it a considerable risk if left uncovered.

Generated by OpenCVE AI on September 17, 2026 at 05:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch or update for Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 from Oracle’s security advisory.
  • Restrict HTTP access to the client bundle to trusted IP ranges or internal networks to limit exposure.
  • Enable requests targeting the client bundle component, and investigate any suspicious activity promptly.

Generated by OpenCVE AI on September 17, 2026 at 05:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via HTTP in Oracle WebCenter Enterprise Capture Client Bundle

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle webcenter Enterprise Capture
CPEs cpe:2.3:a:oracle:webcenter_enterprise_capture:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_enterprise_capture:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle webcenter Enterprise Capture
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Webcenter Enterprise Capture
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:27:29.724Z

Reserved: 2026-08-31T15:40:57.330Z

Link: CVE-2026-83009

cve-icon Vulnrichment

Updated: 2026-09-16T15:42:48.548Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:07.553

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83009

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:30:07Z

Weaknesses