What is the CVSS score of CVE-2026-35284?

CVE-2026-35284 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by CVE-2026-35284?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical remote takeover vulnerability (CVSS 9.9) enabling low-privileged attackers to gain complete system control,…

How to fix or mitigate CVE-2026-35284?

Within 24 hours: Identify and inventory all systems running WebCenter Enterprise Capture versions 12.2.1.4.0 or 14.1.2.0.0; restrict network access to T3 and IIOP listener ports via firewall rules; enable enhanced audit logging. Within 7 days: Implement network segmentation isolating affected systems; deploy continuous monitoring for anomalous T3/IIOP listener access patterns; escalate vendor inquiry to Oracle support for patch availability timeline and roadmap. Within 30 days: Complete assessment of upgrade path to patched versions; if Oracle cannot provide patch ETA within 90 days, initiate procurement evaluation for alternative enterprise capture solutions.

Oracle WebCenter Enterprise Capture CVE-2026-35284

EUVD-2026-37413 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3/IIOP is network-reachable (AV:N), requires only a low-privileged WebLogic account (PR:L), no user interaction, and Oracle confirms scope change with full CIA takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:26 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker who can reach the server's T3 or IIOP listener, with a scope change extending impact to additional Fusion Middleware components. Oracle rates the flaw CVSS 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and the CVE is not currently in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-capture component of Oracle Fusion Middleware that runs on WebLogic Server and exposes Java remoting through the T3 and IIOP protocols on the WebLogic listen port (default 7001) and SSL variants. Historically, vulnerabilities reached through T3/IIOP on WebLogic have involved unsafe deserialization of Java objects in the Client Bundle and related RMI-based interfaces, allowing client-supplied serialized payloads to instantiate gadget chains on the server. The advisory identifies the Client Bundle as the affected component and Oracle's CPU listing tags this as Information Disclosure, but the CVSS C:H/I:H/A:H impact and 'takeover' wording indicate the bug enables far more than read access. No CWE is assigned in the input, but the T3/IIOP attack surface and scope-change behavior are characteristic of deserialization or authorization-bypass classes (CWE-502 / CWE-285) seen previously in WebLogic-hosted components.

RemediationAI

Apply the patches referenced in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) for both 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory; an exact patched build number is not enumerated in the input data and should be taken from the CPU patch matrix at deployment time. Until the CPU can be applied, restrict the WebLogic T3 and IIOP listen ports (default 7001/7002 and the IIOP equivalents) to a tightly scoped management network using a network ACL or the WebLogic 'Connection Filter' (weblogic.security.net.ConnectionFilterImpl) to allow only known administrative hosts, which mitigates remote reachability at the cost of breaking any legitimate remote T3/IIOP clients such as standalone Capture client bundles or integration scripts. Additionally, audit and reduce the number of low-privileged accounts on the Capture/WebLogic realm since PR:L is the only authentication barrier, and rotate credentials for any account that may have been exposed; do not rely on disabling T3 entirely on the AdminServer without testing, as WebLogic clustering and JMX tooling depend on it.