What is the CVSS score of CVE-2026-35280?

CVE-2026-35280 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by CVE-2026-35280?

Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) faces a critical vulnerability enabling remote system takeover by low-privileged authenticated attackers, with potential for lateral…

How to fix or mitigate CVE-2026-35280?

Within 24 hours: Identify and inventory all Oracle WebCenter Enterprise Capture instances (12.2.1.4.0 and 14.1.2.0.0); assess network accessibility and restrict T3/IIOP listener access from untrusted networks. Within 7 days: Implement network segmentation and firewall rules limiting T3/IIOP listener access to authorized systems only; deploy monitoring for unusual authentication and lateral movement activity. Within 30 days: Monitor Oracle Critical Patch Update release channels; upon availability of the June 2026 CPU, test and deploy immediately.

Oracle WebCenter Enterprise Capture CVE-2026-35280

EUVD-2026-37409 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable T3/IIOP (AV:N), Oracle-rated easy exploitation (AC:L), requires any valid low-priv principal (PR:L), no interaction (UI:N), explicit scope change with full takeover (S:C/C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:24 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker reaching the T3 or IIOP listeners, with a scope change that lets the compromise propagate to other Fusion Middleware components. CVSS 3.1 is rated 9.9 due to high confidentiality, integrity, and availability impact across a changed scope, and no public exploit identified at time of analysis. The flaw resides in the Client Bundle component of this document-capture product and is fixed in Oracle's June 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-imaging and ingestion product built on Oracle Fusion Middleware (WebLogic Server), exposing remote management and EJB-style services over the T3 and IIOP protocols. These protocols carry serialized Java objects between WebLogic clients and servers and have historically been a recurring attack surface for Fusion Middleware (e.g., past T3/IIOP deserialization issues like CVE-2020-2555 and CVE-2020-14882). The affected component is the Client Bundle, the client-side libraries used for marshaling capture operations against the server. No CWE is published by Oracle, but the combination of T3/IIOP vector, low privileges, scope change, and full CIA impact strongly matches the unsafe-deserialization / authentication-bypass-leading-to-RCE pattern typical of Fusion Middleware Client Bundle issues.

RemediationAI

Apply Patch available per vendor advisory by installing the fixes for Oracle WebCenter Enterprise Capture shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle does not publish a discrete fixed semver in the description, so consult the CPU patch matrix for the exact PSU/CPU identifier matching your 12.2.1.4.0 or 14.1.2.0.0 deployment. Until patching, restrict network reachability of the WebLogic T3 and IIOP listeners (default 7001/7002) to trusted management subnets only, use the WebLogic connection-filter (weblogic.security.net.ConnectionFilterImpl) to block T3/T3s/IIOP/IIOPs from untrusted sources, and tighten Capture service-account privileges since the flaw needs only PR:L - be aware that filtering T3/IIOP can break legitimate WLST scripts, clustered admin operations, and remote EJB clients, so test in non-prod first. Rotating WebLogic and Capture application credentials is also prudent given the low-privilege precondition.