What is the CVSS score of EUVD-2026-37299?

EUVD-2026-37299 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Capture are affected by EUVD-2026-37299?

Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote complete system takeover with no patch available (CVSS 10.0).

How to fix or mitigate EUVD-2026-37299?

24 hours: Identify all systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0; restrict network access to the RMI Client Bundle component from untrusted sources. 7 days: Contact Oracle support for interim mitigation guidance pending patch release; escalate isolation of affected systems if operationally feasible; increase security monitoring for RMI component exploitation attempts. 30 days: Deploy vendor patch immediately upon release; if no patched version is available within 30 days, execute migration plan to alternative Oracle WebCenter versions or replacement products.

Oracle WebCenter Capture EUVD-2026-37299

| CVE-2026-46781 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Oracle describes unauthenticated, network-reachable RMI exploitation with full CIA takeover and impact on adjacent products, justifying AV:N/AC:L/PR:N/UI:N with scope change and high CIA.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 is possible via the RMI-based Client Bundle component, with a maximum CVSS 3.1 score of 10.0 due to a scope change that impacts additional products. Oracle's June 2026 CPU advisory is the authoritative source, and no public exploit identified at time of analysis, though the AV:N/AC:L/PR:N/UI:N profile makes weaponization plausible once technical details emerge.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document and image capture platform within the Oracle Fusion Middleware stack, used to scan, index, and ingest content into downstream ECM repositories such as WebCenter Content. The affected Client Bundle component communicates with the server over Java Remote Method Invocation (RMI), a protocol historically associated with insecure deserialization and remote class-loading flaws (CWE-502 / CWE-913 class issues), although Oracle's advisory does not enumerate a specific CWE. The scope-change designation (S:C) indicates the RMI entry point allows the attacker to pivot beyond Capture's own security boundary and affect adjacent Fusion Middleware components, which is consistent with shared RMI registries and trust relationships across WebLogic-hosted services.

RemediationAI

Apply the patch available per vendor advisory in the Oracle June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html, which is the primary fix for both 12.2.1.4.0 and 14.1.2.0.0; exact post-patch build identifiers should be taken directly from that advisory since the input does not include a discrete fix version string. Until patching is complete, restrict network reachability of the Capture RMI listener to a small allowlist of management hosts via host firewalls or network ACLs, and place Capture servers behind a segmentation boundary so the RMI registry and object ports are not reachable from general user VLANs - note that overly tight ACLs can break legitimate Client Bundle traffic, so test with the integration accounts before enforcing. As an additional compensating control, audit and constrain WebLogic T3/RMI filters (weblogic.security.net connection filters and JEP 290 serialization filters) to reject untrusted serialized classes, accepting that custom integrations using rich object graphs may need filter exceptions.