Oracle WebCenter Enterprise Capture CVE-2026-46778

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0, provided the attacker can reach the RMI endpoint used by the Client Bundle component over the network. Limiting factors: the RMI port must be network-reachable from the attacker (often blocked from the public internet but commonly reachable inside enterprise networks and DMZs), and the target must run one of the two listed supported versions; if the Capture RMI listener is firewalled off or the Client Bundle component is disabled, exploitation is prevented.

All available signals point to maximum severity: CVSS 3.1 base score is 10.0 with AV:N/AC:L/PR:N/UI:N - a network, low-complexity, unauthenticated, no-user-interaction attack - and S:C indicates the impact extends beyond Capture into other Fusion Middleware products, with full C/I/A compromise (high impact across all three). The issue is not in CISA KEV and no public exploit identified at time of analysis, and EPSS data was not provided, so we cannot quantify exploitation probability; however, Oracle Fusion Middleware RMI flaws have historically attracted rapid weaponization once patches are reverse-engineered. CWE is missing, which limits root-cause specificity, and no NVD enrichment beyond Oracle's own advisory was provided - defenders should treat this as a top-priority patch despite the absence of independent corroboration.

An attacker on a network reachable to the Capture server's RMI port sends a crafted RMI invocation to the Client Bundle component that triggers the underlying flaw, resulting in code execution or full administrative takeover of the Capture service without any credentials or user interaction. Because of the CVSS scope change, the attacker then pivots through trust relationships into adjacent Fusion Middleware services (e.g., WebCenter Content, WebLogic domains) to access stored documents, identities, or backend databases. No public exploit identified at time of analysis, but Oracle Fusion Middleware RMI attack chains are well-understood publicly.