What is the CVSS score of EUVD-2026-37411?

EUVD-2026-37411 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by EUVD-2026-37411?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete remote takeover by low-privileged network users, with impacts extending to adjacent Oracle Fusion…

How to fix or mitigate EUVD-2026-37411?

Within 24 hours: Inventory all WebCenter Enterprise Capture deployments and confirm which versions are active; identify all network-exposed T3 and IIOP protocol endpoints. Within 7 days: Restrict network access to T3 and IIOP endpoints via firewall policies to trusted internal hosts only; contact Oracle support for patch timeline and any interim security guidance. Within 30 days: Develop and test upgrade plan to patched versions; implement network segmentation to isolate vulnerable systems from external-facing infrastructure.

Oracle WebCenter Enterprise Capture EUVD-2026-37411

| CVE-2026-35282 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Webcenter Enterprise Capture Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3/IIOP is network-reachable (AV:N), Oracle calls it easily exploitable (AC:L), a low-privileged account is required (PR:L), no user interaction, and full takeover with cross-product impact justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker reaching the T3 or IIOP protocol endpoints, with a scope change that lets the attack significantly impact additional adjacent products. With a CVSS 3.1 score of 9.9 and high confidentiality, integrity, and availability impact, the flaw resides in the Client Bundle component of Oracle Fusion Middleware. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-capture component of Oracle Fusion Middleware that runs on WebLogic Server and exposes the T3 and IIOP remote-invocation protocols used by WebLogic for clustering, JNDI lookup, and EJB/RMI traffic. The affected 'Client Bundle' component, identified by CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_enterprise_capture, is the client-facing surface for these protocols, and T3/IIOP have historically been a frequent source of deserialization and authentication-bypass vulnerabilities in the WebLogic stack (e.g., the Oracle WebLogic T3 deserialization lineage). No CWE was assigned in the input, but the combination of network-reachable T3/IIOP, low-privilege precondition, scope change, and full CIA impact is characteristic of unsafe deserialization or insecure remote-invocation handling in the Fusion Middleware client bundle.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html for the affected 12.2.1.4.0 and 14.1.2.0.0 versions of Oracle WebCenter Enterprise Capture; Patch available per vendor advisory, but no independently confirmed post-CPU fix version is provided in the input. Until patching, restrict network exposure of the T3 and IIOP listeners using the WebLogic connection-filter mechanism (weblogic.security.net.ConnectionFilterImpl) to allow only management subnets and trusted middle-tier hosts, and front the application with a firewall that blocks the WebLogic admin/managed-server ports from untrusted clients; note this can break legitimate remote EJB/JNDI clients and clustering traffic. Additionally, enforce least privilege on Capture application accounts so that compromised low-privilege credentials cannot reach T3/IIOP endpoints, and monitor WebLogic access logs for anomalous T3/IIOP connections.