Oracle WebCenter Enterprise Capture EUVD-2026-37297

Attacker needs network reachability to the WebCenter Capture host's T3 (or T3s) protocol listener on WebLogic and valid credentials for any low-privileged WebCenter Capture or WebLogic account (PR:L), with no user interaction required. Limiting factors: T3 is commonly firewalled to internal management networks and not exposed to the public internet, and a working credential - even low-privileged - must be obtained first; deployments that have already applied WebLogic connection filters to restrict T3 sources, or that front Capture only via HTTPS, materially reduce exposure. Exploitation is restricted to the affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebCenter Enterprise Capture.

Risk is high in environments where T3 is reachable: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, driven by network reach, low complexity, no user interaction, and scope change with full impact on confidentiality, integrity, and availability. PR:L means the attacker needs some level of authenticated access (any valid low-privileged credential), which is the main limiting factor versus a fully unauthenticated RCE. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation pressure cannot be quantified from the data given - the high CVSS reflects intrinsic severity, not observed exploitation. T3 is frequently restricted to internal networks, so external exposure depends on deployment hygiene; internet-facing T3 endpoints would elevate this from theoretical to urgent.

An attacker who has obtained any low-privileged WebLogic account - for example through phishing of a Capture operator or reuse of a leaked service credential - connects to the WebCenter Capture host's T3 listener over the network and invokes a crafted Client Bundle operation that escapes the Capture component's scope to compromise the underlying WebLogic domain. The result is full takeover of the Capture deployment and significant impact on adjacent Fusion Middleware components hosted in the same domain. No public exploit identified at time of analysis.