Oracle WebCenter Enterprise Capture CVE-2026-35283

Attacker must have network reachability to the WebCenter Enterprise Capture managed server on its T3 (default 7001/7002) or IIOP listener ports and must hold a low-privileged authenticated account on the product (CVSS PR:L). Exploitation is limited to Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 running the Client Bundle component; no user interaction is required (UI:N) and attack complexity is low (AC:L). Environments that already block T3/IIOP at the network edge or via WebLogic connection filters, or that have removed PR:L-equivalent self-service accounts, materially reduce the attack surface.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combined with the 9.9 base score makes this an urgent issue: network reachable, low complexity, only low privileges required, no user interaction, and a scope change that can pivot into other Fusion Middleware products. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and active-exploitation status cannot be confirmed at this time, and no public exploit is identified. T3 and IIOP have a long track record of mass-exploited Oracle vulnerabilities (e.g., prior WebLogic deserialization CVEs), so even without KEV listing, internet- or intranet-exposed instances should be treated as high priority. The 'low privileged' requirement is the only meaningful brake - defenders should not downgrade based on PR:L since legitimate operator accounts in capture/imaging workflows are common.

An attacker with valid low-privileged credentials (for example, a captured operator account or a compromised internal user) opens a T3 or IIOP connection to the WebCenter Enterprise Capture managed server and invokes a vulnerable Client Bundle operation that leads to remote takeover. Due to the scope change, the attacker pivots from the Capture context into other Fusion Middleware components running on the same WebLogic domain, achieving full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but T3/IIOP attack tooling for WebLogic is mature and easily adapted.