What is the CVSS score of CVE-2026-61098?

CVE-2026-61098 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-61098?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete product compromise by low-privileged network attackers, with no public exploit identified at time of…

How to fix or mitigate CVE-2026-61098?

Within 24 hours: Identify all systems running Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 or 14.1.2.0.0 and assess network exposure of the Client Bundle component to untrusted networks. Implement immediate network access controls to restrict HTTP connectivity to the vulnerable component from low-privileged or external accounts. Within 7 days: Deploy compensating controls including network segmentation, IP whitelisting, and enhanced logging on all affected systems to detect exploitation attempts. Contact Oracle to confirm patch availability and timeline for your licensed versions, and begin change management planning for emergency patching. Within 30 days: Apply vendor patch to all affected systems as soon as available, conduct forensic analysis for any signs of compromise during the vulnerability window, and implement long-term network hardening to restrict future access to the Client Bundle component.

Oracle WebCenter Capture CVE-2026-61098

EUVD-2026-47309 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-wg9m-cfjf-x7fc

Privilege Escalation Oracle Webcenter Enterprise Capture

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and no user interaction; a low-privilege account is required (PR:L), and product takeover yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:49 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-capture and imaging module within Oracle Fusion Middleware, used to scan, index, and ingest documents into enterprise content-management workflows. The flaw resides in the Client Bundle component, the client-facing distribution used to interact with the Capture server over HTTP. Oracle assigned no CWE (CWE: N/A) and, consistent with its CPU disclosure practice, does not publish root-cause detail; the 'takeover' phrasing combined with a low-privilege, network-reachable vector is typical of authorization or input-handling weaknesses in the client-server exchange. No CPE strings were provided; affected products are identified from Oracle's advisory and the ENISA EUVD record rather than an NVD CPE match.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-authoritative remediation; treat this as 'Patch available per vendor advisory,' since the CPU does not expose a single discrete fixed build number in the provided data - obtain the exact patch for your 12.2.1.4.0 or 14.1.2.0.0 deployment from My Oracle Support. Because the attack is network-based over HTTP against the Client Bundle, compensating controls until patching completes include restricting network reachability of the Capture server to trusted management networks or VPN only, placing it behind a reverse proxy or WAF that limits access to the Capture client endpoints, and tightening account provisioning so that low-privilege accounts (which satisfy the PR:L requirement) are minimized and monitored; the trade-off is reduced accessibility for legitimate remote capture clients and added operational overhead. Do not rely on network controls as a permanent substitute for the CPU patch.