Oracle WebCenter Enterprise Capture EUVD-2026-37411

Attacker must have network reachability to the WebLogic T3 or IIOP listener of the Oracle WebCenter Enterprise Capture deployment (typically the WebLogic managed-server port, default 7001 or a site-specific port) and must hold low-privilege credentials (PR:L) for the product, with no user interaction required (UI:N) and low attack complexity (AC:L). Exploitation is limited to Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 with the Client Bundle component reachable; deployments that have already restricted T3/IIOP via WebLogic connection filters, or that expose only HTTPS to untrusted networks, materially reduce exposure. The scope change (S:C) means a successful attack can affect components beyond Capture itself within the same WebLogic domain.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 and indicates that any account with even minimal application-level credentials and network reach to T3/IIOP can fully take over the product and pivot beyond its trust boundary, which is a true Critical. Oracle itself labels the issue 'easily exploitable,' reinforcing the low attack-complexity rating. No EPSS score, no CISA KEV listing, and no public POC were provided, so realistic risk today is high-severity but not yet evidenced as widely exploited; the gap between CVSS criticality and absence of public exploitation data should be tracked, as Fusion Middleware T3/IIOP flaws have repeatedly been weaponized after Oracle CPU disclosure. CWE is N/A in the input, so the exact bug class (likely deserialization, but not confirmed) is inferred from the protocol surface rather than stated by Oracle.

An attacker who has obtained or registered a low-privileged Capture/WebLogic account, or has reached an internally exposed managed-server port, sends a crafted T3 or IIOP request to the Client Bundle endpoint and triggers the vulnerability, gaining control of the WebCenter Enterprise Capture instance. Because the CVSS scope is Changed, the attacker then leverages that foothold to act on adjacent Fusion Middleware components running on the same WebLogic domain. No public exploit identified at time of analysis, but the AC:L rating implies a reliable exploit is feasible once details are reverse-engineered from the Oracle CPU patch.