EUVD-2026-79692
GHSA-7hf9-jr3v-pw57
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Unauthenticated HTTP exploitation of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can lead to full takeover of the application. The vulnerability resides in the Client Bundle component and is easily exploitable over the network without credentials. No public exploit or CISA KEV listing was identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Webcenter Enterprise Capture gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Enterprise Capture
View allFull takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle co
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-p
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privi
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-bas
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) al
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-p
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achie
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects support
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthent
Exploit-DB