What is the CVSS score of EUVD-2026-37410?

EUVD-2026-37410 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Enterprise Capture are affected by EUVD-2026-37410?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to account takeover attacks that require only low-privilege network access and can propagate to connected…

How to fix or mitigate EUVD-2026-37410?

Within 24 hours: Inventory systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0; enumerate network exposure to T3 and IIOP protocols. Within 7 days: Restrict T3 and IIOP protocol access to trusted administrative networks only via firewall rules; enable comprehensive audit logging for account and privilege events; review and restrict service account permissions to minimum required. Within 30 days: Monitor Oracle's CPU advisories for patch release and plan immediate deployment of patched version; evaluate business continuity options if patch timeline extends; test protocol filtering impact on legitimate operations.

Oracle WebCenter Enterprise Capture EUVD-2026-37410

| CVE-2026-35281 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3/IIOP is network-reachable (AV:N), Oracle states easily exploitable (AC:L), a low-privileged account is required (PR:L), no user interaction, and takeover with cross-product impact justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:24 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged attacker with network access to the T3 or IIOP protocols. The CVSS 9.9 score reflects a scope-changing flaw in the Client Bundle component that can pivot beyond the originally compromised product, with full impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis, but Oracle's own CPU advisory confirms the issue and the low attack complexity makes it a high-priority patching target.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture platform built on Oracle Fusion Middleware / WebLogic Server, exposing the proprietary T3 protocol and CORBA-based IIOP for remote management and client-server communication. These protocols are historically a high-value attack surface in the WebLogic stack, repeatedly abused for deserialization and authentication-bypass flaws (e.g., the Coherence and Tuxedo CVE families). The vulnerability resides in the Client Bundle subcomponent and produces a scope change (S:C in CVSS), meaning the security authority of the exploited component is exceeded - typical of WebLogic flaws that traverse into adjacent JVMs, managed servers, or downstream Fusion Middleware products. No CWE is published by Oracle, but the T3/IIOP attack vector combined with full CIA impact at low complexity is consistent with the unsafe-deserialization or authentication-flaw classes seen in prior WebLogic CVEs.

RemediationAI

Patch available per vendor advisory: apply the fixes shipped in the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html for WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0; no exact post-patch build number is enumerated in the input, so confirm the version against Oracle's CPU matrix before deploying. As compensating controls until the CPU is applied, restrict network reachability of T3 and IIOP listeners to a trusted management VLAN using WebLogic Connection Filters (weblogic.security.net.ConnectionFilterImpl) or perimeter firewalling - note this can break legitimate JMS, RMI, and WLST client integrations and must be tested. Additionally, tighten WebLogic user roles so no untrusted account holds even the low privilege the CVSS vector assumes, and enable IIOP only if actively used (disable in the protocols configuration otherwise), accepting that downstream CORBA clients will lose connectivity.