What is the CVSS score of CVE-2026-46782?

CVE-2026-46782 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by CVE-2026-46782?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to remote takeover by authenticated, low-privileged users via the Client Bundle component, with scope change…

How to fix or mitigate CVE-2026-46782?

24 hours: Identify and inventory all systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0; immediately restrict network access to the Client Bundle component to trusted networks only. 7 days: Implement Web Application Firewall rules to monitor Client Bundle traffic; evaluate upgrade options to non-vulnerable versions when released. 30 days: Complete remediation through version upgrade or deploy compensating controls; establish ongoing security monitoring for suspicious Client Bundle access.

Oracle WebCenter Enterprise Capture CVE-2026-46782

EUVD-2026-37300 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable Client Bundle (AV:N/AC:L), any low-privileged Capture account suffices (PR:L), no user interaction, and full CIA takeover crossing into other Fusion Middleware products justifies S:C with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker with HTTP access to the Client Bundle component, with scope change extending impact to other Oracle Fusion Middleware products. CVSS 9.9 reflects easy exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is an enterprise document-imaging and ingestion component of Oracle Fusion Middleware used to scan, classify, and route documents into content management systems. The vulnerable Client Bundle is the HTTP-facing client integration layer that brokers requests from authenticated users into the Capture backend. The CPE string cpe:2.3:a:oracle_corporation:oracle_webcenter_enterprise_capture confirms the affected product family, and the CVSS scope-change flag (S:C) indicates the flaw allows the attacker to break out of the Capture security authority and impact additional Fusion Middleware products sharing the trust boundary. No CWE was assigned by Oracle, which is typical for their Critical Patch Update disclosures.

RemediationAI

Apply the patches from the Oracle Critical Patch Update June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html; specific patched build numbers are listed in that advisory and should be applied to both the 12.2.1.4.0 and 14.1.2.0.0 branches (patch available per vendor advisory; no standalone fix version is enumerated in the available data). Until patches can be staged, restrict network access to the WebCenter Capture HTTP endpoints to trusted management networks and segment the Capture tier from other Fusion Middleware services to constrain the scope change (note this will break legitimate document-ingest clients that connect over the network). Audit and reduce the population of low-privileged Capture accounts and rotate their credentials, since PR:L is the only barrier to exploitation; the trade-off is operational overhead for client integrations that authenticate as service users.