Oracle WebCenter Enterprise Capture CVE-2026-35285

Attacker must hold valid low-privilege credentials (PR:L) on Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 and must have network reachability to the WebLogic T3 or IIOP listener ports - typically TCP 7001/7002 or custom-configured equivalents - on the Capture server. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once auth and network access are present, exploitation is straightforward. Limiting factors: the T3 and IIOP protocols are commonly restricted to internal networks rather than internet-exposed, and environments using WebLogic Connection Filters or disabling IIOP will block the attack path; the requirement for a low-privilege account also means fully unauthenticated internet scanners cannot directly exploit this without first obtaining credentials.

This is a genuine high-priority issue: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 - network-reachable, low-complexity, only low privileges required, no user interaction, and scope change with full CIA impact. T3 and IIOP have a long track record of being exposed to internal networks (and sometimes the internet) and have been the vector for multiple weaponized WebLogic exploits over the past decade, which raises the practical likelihood of exploit development even though no public exploit is identified at time of analysis. EPSS and KEV status were not supplied in the input, and no CWE was assigned, so exploitation probability and root-cause class are inferred rather than confirmed. The primary mitigating factor is that PR:L requires the attacker to already hold valid low-privilege credentials or another foothold to authenticate to the T3/IIOP listener - a meaningful but routinely satisfied bar in enterprise environments where service accounts and internal users abound.

An attacker who has obtained a low-privilege Oracle WebCenter Enterprise Capture account - for example through a phished employee, a reused password, or lateral movement from another internal host - connects to the exposed T3 or IIOP listener over the network and sends a crafted Client Bundle request that triggers the vulnerability. Because of scope change, the resulting code execution or authority escalation reaches beyond Capture itself into co-hosted Fusion Middleware components, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, but T3/IIOP attack tooling is widely available from prior WebLogic research and would lower the development barrier substantially.