Oracle WebCenter Enterprise Capture CVE-2026-35281

Attacker must have network reachability to the Oracle WebCenter Enterprise Capture instance over the T3 or IIOP protocols (the WebLogic management/RMI channels) and must hold a low-privileged account on the target (PR:L in the CVSS vector). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once those two prerequisites are met exploitation is straightforward against the named versions 12.2.1.4.0 and 14.1.2.0.0. Realistic limiting factors: deployments that firewall T3/IIOP off the general network, disable IIOP, or use WebLogic Connection Filters to whitelist client IPs materially raise the bar; conversely, internet-exposed T3/IIOP listeners - a known misconfiguration pattern - make exploitation trivial.

Risk is high and patching should be prioritized: CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H means a single low-privileged account on a network-reachable T3/IIOP endpoint is sufficient for full takeover with cross-product impact. Oracle's SSVC-equivalent signals (Easily exploitable, scope change, takeover) reinforce that this is automatable in principle, and the T3/IIOP attack surface has a long history of weaponized exploitation in the WebLogic ecosystem. Counterbalancing signals: no EPSS score, KEV status, or public POC was provided in the input, so there is no current evidence of in-the-wild exploitation - risk is therefore credible and structurally severe but not yet confirmed as actively exploited. Note also a partial signal conflict: the tag set includes 'Information Disclosure' while the description states full takeover and C:H/I:H/A:H, so the tag understates real impact.

An attacker who has obtained or been granted a low-privileged WebCenter/WebLogic account - for example via a phished operator credential or an over-provisioned integration user - connects to the exposed T3 or IIOP port and sends a crafted request to the Client Bundle interface. The flaw allows full compromise of the WebCenter Enterprise Capture instance and, due to scope change, pivot into adjacent Fusion Middleware components running on the same domain. No public POC is referenced in the input, but T3/IIOP exploitation tooling is mature in the offensive community.