Oracle WebCenter Enterprise Capture CVE-2026-35280

Attacker must reach the Oracle WebLogic T3 or IIOP listener of the WebCenter Enterprise Capture managed server (typically TCP 7001/7002 or the IIOP equivalent) and must already hold a low-privileged authenticated principal on the WebLogic/Capture domain (PR:L). No user interaction is required (UI:N) and attack complexity is low (AC:L), but exploitation is limited to deployments running the affected Capture versions 12.2.1.4.0 or 14.1.2.0.0 with the Client Bundle component reachable; environments that already restrict T3/IIOP via WebLogic connection filters, firewall the management ports, or only expose HTTP front-ends to untrusted networks substantially reduce realistic exposure.

All available signals converge on a high real-world priority. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects easy network exploitation by any authenticated WebLogic principal with full CIA impact and scope change beyond Capture into adjacent Fusion Middleware products. Oracle itself classifies it as 'easily exploitable,' which historically correlates with reliable exploitation once details surface. Offsetting factors: T3/IIOP are typically internal-only and PR:L means an attacker still needs some valid credential or weak service account; EPSS, KEV, and POC data are not provided in this input, so 'no public exploit identified at time of analysis' should not be read as low likelihood - Oracle CPU bugs commonly see PoCs within weeks of disclosure. No conflicting signals were observed; the main uncertainty is the absence of independent KEV/EPSS data and a published CWE.

An attacker who obtains any low-privileged WebLogic or Capture account (e.g., via phishing, credential reuse, or a foothold on an adjacent internal host) opens a T3 or IIOP connection to the WebCenter Capture managed server and submits a crafted Client Bundle request that abuses the flaw to execute attacker-controlled logic in the server JVM. Because the CVSS vector includes S:C, the attacker can pivot beyond Capture into other co-hosted Fusion Middleware components, ultimately achieving full takeover of the Capture instance and impacting adjacent services. No public exploit identified at time of analysis, but Oracle rates the issue as easily exploitable.