Oracle WebCenter Capture EUVD-2026-46841

The attacker must have network reachability to the Oracle WebLogic T3 or IIOP protocol listener fronting WebCenter Enterprise Capture, and must hold low-level privileges (CVSS PR:L - authentication is required, not anonymous access). The affected build must be 12.2.1.4.0 or 14.1.2.0.0. Limiting factors: exploitation requires that T3/IIOP is exposed to the attacker's network position (these are typically internal WebLogic ports, not intended for public exposure) and that the attacker already possesses valid low-privileged credentials; no user interaction and no special non-default feature toggle is described, so a default installation reachable over T3/IIOP by an authenticated low-priv user is exploitable.

The signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity attack needing only low privileges, no user interaction, with full CIA impact and a scope change - Oracle explicitly calls it 'easily exploitable' and capable of product takeover, yielding the 9.9 score. Exposure of T3/IIOP is the key aggravator: these ports are frequently reachable inside enterprise networks and this protocol family has a long track record of reliable weaponization in Oracle/WebLogic CPUs. Counterbalancing this, no EPSS score, no KEV listing, and no POC were provided, so real-world exploitation is currently unproven and cannot be assumed widespread. The 'Information Disclosure' tag is narrower than the vector's full C/I/A takeover claim - treat the vector and Oracle's takeover statement as authoritative and the tag as incomplete metadata.

An attacker who holds a low-privileged account and can reach the WebLogic T3 or IIOP listen port sends a crafted remote invocation to the WebCenter Capture Client Bundle component. With low attack complexity and no user interaction, the request drives the server to execute attacker-controlled operations, resulting in takeover of the Capture instance and, via the scope change, impact on other products in the WebLogic domain. No public proof-of-concept was identified at the time of analysis.