Oracle WebCenter Capture CVE-2026-61098

Exploitation requires network access to the Oracle WebCenter Enterprise Capture server over HTTP and a low-privileged authenticated account (CVSS PR:L), targeting the Client Bundle component of versions 12.2.1.4.0 or 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so a single valid low-tier credential plus HTTP reachability is sufficient. Limiting factors that reduce real-world risk: the attacker must first obtain a valid low-privilege account, and the Capture endpoint must be network-reachable - instances confined to segmented internal networks or requiring VPN access sharply narrow the exposed population.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full C/I/A compromise - a genuinely high-priority signal for any exposed instance. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability signals are absent rather than reassuring; absence of data is not evidence of low risk. Oracle rates the vulnerability 'easily exploitable,' which reinforces the AC:L judgment. Because PR:L requires the attacker to already hold some authenticated foothold, real-world risk is highest where Capture is internet-facing or where low-tier accounts are broadly provisioned; conversely, instances behind strong network segmentation and tight account controls face materially lower exposure. The CVSS vector and Oracle's narrative are internally consistent, so no conflict needs flagging beyond the missing EPSS/KEV telemetry.

An attacker who holds a low-privileged application account (or has phished/obtained such credentials) sends crafted HTTP requests to the Oracle WebCenter Enterprise Capture Client Bundle interface and abuses the flaw to escalate to full control of the Capture instance, reading or altering ingested documents and disrupting service. No user interaction is required and the attack complexity is low, making exploitation straightforward once network access and a foothold account exist. No public proof-of-concept has been identified at time of analysis.