What is the CVSS score of CVE-2026-61100?

CVE-2026-61100 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-61100?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical unauthenticated remote vulnerability enabling complete system takeover through the HTTP-exposed Client Bundle…

How to fix or mitigate CVE-2026-61100?

Within 24 hours: Use asset inventory or network scanning to identify all systems running Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 or 14.1.2.0.0, and immediately isolate affected instances from internet-facing networks. Within 7 days: Implement network segmentation to restrict HTTP access to the Client Bundle component to authorized internal networks only, and deploy Web Application Firewall rules to block suspicious requests targeting the vulnerable endpoint. Within 30 days: Coordinate with Oracle support for patch delivery timeline, test migration or upgrade paths to unaffected versions, or establish permanent network-level controls if patching cannot be completed within operational constraints.

Oracle WebCenter Capture CVE-2026-61100

EUVD-2026-47311 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-mx5r-gxq2-qvhq

Authentication Bypass Oracle Webcenter Enterprise Capture

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated, easily exploitable HTTP access resulting in full takeover, so AV:N/AC:L/PR:N/UI:N with complete C/I/A impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:49 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.

Technical ContextAI

Oracle WebCenter Enterprise Capture is an enterprise document-capture and imaging platform within Oracle Fusion Middleware, used to scan, index, and ingest documents into content-management repositories. The vulnerable element is the Client Bundle component, the client-facing tier that communicates with the Capture server over HTTP. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unstated; however, the combination of unauthenticated network access resulting in full 'takeover' is consistent with an authentication-bypass or unauthenticated-request-handling weakness in the HTTP-exposed client bundle services. The 'Information Disclosure' tag hints at data exposure as one facet, though the full C/I/A impact indicates the consequences extend beyond disclosure to complete compromise.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle CPU advisories bundle the corrective patches per product and version, and Oracle strongly recommends applying the CPU without delay. No exact fixed build number was provided in the input, so Patch available per vendor advisory - consult the July 2026 CPU patch matrix for the specific WebCenter Enterprise Capture patch. Until patching, reduce exposure by restricting network access to the Capture Client Bundle HTTP endpoints to trusted management networks or VPN only, and placing the service behind a reverse proxy or WAF that enforces authentication and filters unexpected requests; the trade-off is that legitimate remote capture clients may lose direct connectivity and require reconfiguration to route through the restricted path. Because the vector is unauthenticated HTTP, network segmentation and blocking external access to the Capture service ports are the most effective compensating controls if patching must be delayed.