Oracle WebCenter Capture CVE-2026-61100

The only prerequisite is network HTTP reachability to the Oracle WebCenter Enterprise Capture Client Bundle component on an affected version (12.2.1.4.0 or 14.1.2.0.0); the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity. In practice this is unauthenticated remote exploitation against default deployments of the Capture service. The primary limiting factor is exposure: exploitation requires the attacker to be able to reach the Capture Client Bundle HTTP endpoint, so instances confined to segmented internal networks or behind authenticating proxies present a materially reduced attack surface. Only the two named versions are confirmed affected.

All CVSS signals point to maximum severity: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and H/H/H impact yield a 9.8 base score, and Oracle explicitly characterizes it as 'easily exploitable.' Scope is unchanged (S:U), so impact is confined to the Capture instance itself rather than crossing a trust boundary. Countervailing this, exploitation-in-the-wild signals are absent: the CVE is not in CISA KEV, no EPSS score was supplied, and no public POC is referenced, so real-world exploitation is currently unproven. No SSVC decision data was provided. Net assessment: a genuine high priority because the barrier to exploitation is minimal and the product is internet- or intranet-reachable, but the current exploitation likelihood is inferred from CVSS rather than observed activity - EPSS and KEV data are missing and should be monitored.

An attacker who can reach the Oracle WebCenter Enterprise Capture Client Bundle HTTP interface - from the internet or an internal network - sends a crafted request that requires no credentials and no user interaction, exploiting the flaw to gain full control of the Capture instance. Because Oracle rates it easily exploitable with low complexity, a single automated request could achieve compromise, though no public POC has been published to date.