Oracle WebCenter Enterprise Capture CVE-2026-46782

Exploitation requires network reachability to the Oracle WebCenter Enterprise Capture HTTP interface and a valid low-privileged account on the Capture deployment (PR:L per the CVSS vector); no user interaction or special non-default configuration is called out by Oracle. Limiting factors are the authentication requirement and the need for the Capture Client Bundle endpoints to be reachable from the attacker's network - instances fronted only by an internal management VLAN reduce, but do not eliminate, exposure because insider or compromised-credential abuse still succeeds. Only versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed affected.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H paints a serious picture: network-reachable HTTP exploitation, low attack complexity, only low privileges required, no user interaction, and full CIA impact crossing a scope boundary. The PR:L requirement is the only meaningful limiter - any account on the Capture deployment, however low-privileged, is sufficient. EPSS and KEV data are not present in the input, so probability of exploitation in the wild cannot be quantified, and no POC has been published yet. Because this comes from the Oracle Critical Patch Update channel and Fusion Middleware is widely deployed in enterprise environments, the realistic priority is high despite the absence of public exploit code - historically Oracle WebCenter flaws have attracted post-disclosure reverse engineering.

An attacker who has obtained any low-privileged Oracle WebCenter Enterprise Capture account - for example through a phished helpdesk user or a leaked service-integration credential - sends crafted HTTP requests to the Client Bundle component and takes over the Capture instance, then pivots through the scope change to attack adjacent Fusion Middleware components such as the shared identity or content store. No user interaction is required and attack complexity is low, so the chain is fully scriptable once a foothold credential is in hand. No public exploit identified at time of analysis.