What is the CVSS score of CVE-2026-61099?

CVE-2026-61099 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-61099?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing low-privileged network users to achieve complete system takeover with full impact on…

How to fix or mitigate CVE-2026-61099?

Within 24 hours, complete inventory of all Oracle WebCenter Enterprise Capture deployments running versions 12.2.1.4.0 or 14.1.2.0.0, identify network-accessible instances, and immediately restrict HTTP/HTTPS access to the Client Bundle component using firewall rules to untrusted networks. Within 7 days, implement network segmentation to isolate affected systems from external access, enforce mutual TLS authentication for all Client Bundle connections, disable the Client Bundle component on systems that do not require it, and deploy monitoring to detect authentication anomalies and suspicious data access. Within 30 days, escalate to Oracle support to assess emergency patching or migration options to unaffected versions, conduct a security audit of all exposed systems, and transition to patched versions immediately upon vendor release.

Oracle WebCenter Capture CVE-2026-61099

EUVD-2026-47310 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vf9h-v5g7-5h4c

Privilege Escalation Oracle Webcenter Enterprise Capture

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable (AV:N), easily exploitable per vendor (AC:L), requires a valid low-privileged account (PR:L), no user interaction, and full application takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:49 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture platform within Oracle Fusion Middleware, used to scan, index, and route documents into enterprise content management workflows. The vulnerable component is the Client Bundle, the client-facing tier that communicates with the Capture server over HTTP. Oracle did not assign a CWE (CWE: N/A) and published no technical root-cause detail beyond the CVSS metrics; the full C:H/I:H/A:H impact combined with 'takeover' language indicates the flaw lets an authenticated user escape their intended privilege boundary and gain control of the application, consistent with a broken access control, unsafe deserialization, or injection class in the client-server protocol, though the exact mechanism is not disclosed.

RemediationAI

Apply the Critical Patch Update fixes for Oracle WebCenter Enterprise Capture per Oracle's July 2026 CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; no discrete fix version string was published in the provided data, so identify the exact patch for your 12.2.1.4.0 or 14.1.2.0.0 branch via the CPU patch matrix). Until patching, reduce exposure by restricting network access to the Capture client/server HTTP endpoints so they are reachable only from trusted management networks or via VPN rather than broadly to all internal users, which limits who can reach the vulnerable Client Bundle at the cost of less convenient access for legitimate remote capture users. Tighten and audit low-privilege Capture accounts and disable unused ones, since PR:L exploitation depends on possession of a valid credential; note this does not remove the vulnerability, only the pool of accounts that can trigger it.