Oracle WebCenter Enterprise Capture EUVD-2026-37413

Exploitation requires (1) network reachability to the WebLogic T3 or IIOP listener of the Oracle WebCenter Enterprise Capture deployment - these are non-HTTP Java remoting ports and are frequently restricted to internal or management networks - and (2) a valid low-privileged account on the WebLogic/Capture security realm (CVSS PR:L), so fully anonymous internet exploitation is not in scope per the vendor's CVSS vector. No user interaction is needed (UI:N), attack complexity is low (AC:L), and only versions 12.2.1.4.0 and 14.1.2.0.0 of WebCenter Enterprise Capture are listed as affected; deployments that have firewalled T3/IIOP off the general network or that have no shared low-privileged accounts substantially limit realistic exploitability.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is severe: network-reachable, low complexity, only a low-privileged account needed, no user interaction, and a scope change that lets the compromise reach other Fusion Middleware products co-hosted on the same WebLogic domain. The most realistic risk gating factor is exposure of the WebLogic T3/IIOP listener - in mature deployments these are firewalled to internal management networks, which sharply reduces the population of internet-reachable targets, but in many enterprise installs they remain reachable from broad internal segments. No EPSS score, KEV listing, or public POC was supplied, so probability of opportunistic mass exploitation cannot yet be quantified; however, Oracle Fusion Middleware T3/IIOP bugs have a strong historical track record of being weaponized within weeks of CPU disclosure, so this should be treated as a high-priority patch despite the lack of current exploitation evidence. The 'Information Disclosure' tag in the input conflicts with the C:H/I:H/A:H 'takeover' wording and should be disregarded in favor of the CVSS vector and Oracle's own description.

An attacker who has obtained any low-privileged account on the Capture/WebLogic realm - for example, a basic Capture operator credential harvested via phishing or reused from another internal system - connects to the WebLogic listen port and sends a crafted T3 or IIOP request to the Client Bundle interface. The request causes the server to process attacker-controlled data in a way that yields code execution or full administrative takeover within the WebLogic JVM, and because the CVSS scope is changed, the attacker then pivots into other Fusion Middleware components hosted in the same domain to exfiltrate documents and persist. No public exploit identified at time of analysis, but the T3/IIOP attack surface on WebLogic has been repeatedly targeted by both commodity and APT actors after Oracle CPU disclosures.