What is the CVSS score of CVE-2026-46779?

CVE-2026-46779 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by CVE-2026-46779?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete system takeover by authenticated remote attackers with low-privileged access; no public exploit…

How to fix or mitigate CVE-2026-46779?

Within 24 hours: Inventory all instances of Oracle WebCenter Enterprise Capture running versions 12.2.1.4.0 or 14.1.2.0.0 and disable or restrict network access to T3 protocol endpoints from untrusted networks. Within 7 days: Implement network segmentation to isolate affected systems from critical infrastructure and deploy enhanced monitoring and alerting on T3 endpoint access attempts. Within 30 days: Contact Oracle for patch release timeline, evaluate migration to patched versions (13.x or later if available), or implement compensating control framework if patching timeline exceeds risk tolerance.

Oracle WebCenter Enterprise Capture CVE-2026-46779

EUVD-2026-37297 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3 is network-reachable (AV:N) and easily exploitable (AC:L) per Oracle, requires a low-privileged account (PR:L), no user interaction, and scope change with full CIA impact on Capture and adjacent products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:08 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3 to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle WebCenter Enterprise Capture is achievable by a low-privileged remote attacker via the T3 protocol in the Client Bundle component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can significantly impact additional adjacent products beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic Server. The vulnerable Client Bundle component is reachable over T3, Oracle WebLogic's proprietary RMI-style protocol used by Java clients for remote method invocation. T3 endpoints have historically been a recurring source of critical Fusion Middleware vulnerabilities because they expose Java object deserialization and remote service invocation paths. No CWE was assigned in the input, but the combination of T3 attack vector, low complexity, and full CIA impact with scope change is consistent with the deserialization or unsafe remote method class typical of WebLogic-hosted services.

RemediationAI

Apply the fixes published in Oracle's June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html for both 12.2.1.4.0 and 14.1.2.0.0 deployments; exact patched version strings are not enumerated in the input and should be taken from the CPU matrix. As compensating controls until patching, restrict T3 and T3s protocol access using WebLogic's network connection filters (weblogic.security.net.ConnectionFilterImpl) to permit only trusted management subnets, which will break legitimate remote Java client integrations that rely on T3 - validate JMS and remote EJB consumers before enforcing. Additionally, place WebCenter Capture behind a segmented management VLAN and block T3/T3s (default ports 7001/7002 or the configured listen port) at the perimeter, and rotate any low-privileged WebLogic accounts whose credentials may be at risk of reuse, since the attack requires PR:L.