What is the CVSS score of EUVD-2026-37414?

EUVD-2026-37414 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Enterprise Capture are affected by EUVD-2026-37414?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing low-privileged authenticated users to achieve complete system takeover with blast…

How to fix or mitigate EUVD-2026-37414?

Within 24 hours: Identify all systems running WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0; restrict T3 and IIOP protocol access via firewall to essential systems only; enable detailed audit logging. Within 7 days: Implement least-privilege access controls restricting low-privileged user capabilities; enforce multi-factor authentication for any elevated WebCenter accounts; establish network segmentation between WebCenter and adjacent Fusion Middleware systems. Within 30 days: Establish and begin execution of upgrade/migration plan to a patched WebCenter version or approved alternative; validate any configuration hardening guidance from Oracle security advisories.

Oracle WebCenter Enterprise Capture EUVD-2026-37414

| CVE-2026-35285 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Webcenter Enterprise Capture Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3/IIOP is network-reachable (AV:N), exploit is straightforward (AC:L), low-privilege auth required (PR:L), no user interaction (UI:N), scope change to adjacent Fusion Middleware (S:C), full CIA takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:27 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged remote attacker reaching the server via T3 or IIOP protocols, with scope change allowing impact on adjacent products in the Fusion Middleware stack. The CVSS 3.1 base score of 9.9 reflects full confidentiality, integrity, and availability compromise with low attack complexity, and no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture component within Oracle Fusion Middleware, built on the WebLogic Server platform. The affected attack surface is the Client Bundle component reachable over T3 (WebLogic's proprietary RMI protocol) and IIOP (CORBA-based Internet Inter-ORB Protocol) - both well-known vectors historically abused in Oracle WebLogic deserialization and authentication-bypass vulnerabilities. The CPE cpe:2.3:a:oracle_corporation:oracle_webcenter_enterprise_capture identifies the affected product, and the scope change (S:C) indicates the vulnerable component can pivot to compromise resources beyond its own security authority, typical of WebLogic-hosted components that share JVM/classloader context with other Fusion Middleware services. No CWE was assigned by the reporter, but the T3/IIOP attack surface and scope-change behavior are strongly consistent with Java deserialization (CWE-502) or authentication/authorization weaknesses common to this protocol family.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cspujun2026.html - exact fix build numbers are listed in that advisory and should be cited per environment rather than inferred. Until patches are deployed, restrict network access to the WebLogic T3 and IIOP listeners using a Connection Filter (weblogic.security.net.ConnectionFilterImpl) to allow only trusted management hosts, and place the Capture server behind a network segmentation boundary or firewall that blocks T3/IIOP from untrusted networks; note that overly aggressive filtering can break legitimate WebLogic clustering, JMS clients, and management tooling, so test in a staging environment. Disabling IIOP entirely in the WebLogic server protocols configuration is an additional hardening step if no CORBA clients are in use. Rotate credentials for any low-privilege accounts that could be used to authenticate to T3/IIOP, since PR:L means a stolen low-tier credential is sufficient for full takeover.