Oracle WebCenter Capture EUVD-2026-37299

Exploitation requires network reachability to the Oracle WebCenter Enterprise Capture server's RMI listener (Client Bundle component) on a host running version 12.2.1.4.0 or 14.1.2.0.0; no authentication, no user interaction, and no special configuration toggles are called out by Oracle, so default deployments that expose RMI to reachable network segments are vulnerable. Practical limits on exploitation are environmental rather than technical: Capture is normally deployed inside the enterprise perimeter, so attackers must already have routed access to the WebLogic RMI ports (commonly the T3/T3S/IIOP listeners), and organizations that have applied WebLogic connection filters or JEP 290 deserialization filters may blunt - but not necessarily block - exploitation depending on the underlying class gadget.

All available signals point to top-tier priority: CVSS 3.1 base is 10.0 with AV:N/AC:L/PR:N/UI:N and a scope change, meaning a network-reachable, unauthenticated attacker with low complexity can fully compromise confidentiality, integrity, and availability and reach beyond the vulnerable product. EPSS and CISA KEV data are not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild use are unknown; absence is not evidence of safety, particularly for an Oracle CPU-rated 10.0 over RMI. No POC is referenced, but Oracle CPU bugs of this class are routinely reverse-engineered from patch diffs within days. The only mitigating signal is that Capture is typically deployed inside enterprise networks rather than internet-exposed, which can reduce - but not eliminate - real-world exposure if RMI ports are reachable from semi-trusted zones.

An attacker with network reachability to the Capture server's RMI port crafts a malicious RMI invocation against the Client Bundle endpoint, triggering the underlying flaw without any credentials or user interaction. Because the scope changes, the resulting code execution or service takeover extends beyond Capture into adjacent Fusion Middleware components sharing the same WebLogic domain, enabling lateral movement to content repositories and integration accounts. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N profile makes this a strong candidate for rapid post-patch exploit development.