EUVD-2026-46842
GHSA-34mv-vh59-6543
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebLogic T3/IIOP listen port
-
DeliverySend crafted serialized object stream
-
ExploitTrigger unsafe server-side processing
-
ExecutionExecute attacker-controlled logic
-
ImpactAchieve full application takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The concrete prerequisite is network reachability to the Oracle WebLogic T3 or IIOP protocol listener that fronts WebCenter Enterprise Capture (the CVSS vector confirms AV:N/AC:L/PR:N/UI:N - unauthenticated, no user interaction). Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected. The primary limiting factor is exposure of the T3/IIOP port: instances where these protocols are firewalled off, disabled, or restricted via a WebLogic connection filter to trusted hosts are not remotely exploitable by arbitrary attackers, so realistic risk hinges on whether the listen port is reachable from untrusted networks rather than on any special application configuration. |
| Impact | All confirmed severity signals point the same direction: the Oracle-supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical), meaning network-reachable, low-complexity, no privileges and no user interaction, with high impact across confidentiality, integrity and availability, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' EPSS and SSVC data were not provided in the input, so exploitation probability and automatability cannot be quantified here. There is no POC and no CISA KEV listing, so this is a high-CVSS issue without evidence of current active or public exploitation - the risk is driven by the exposed unauthenticated T3/IIOP attack surface rather than observed attacks. The 'Information Disclosure' tag understates the CIA:High vector; treat the full takeover impact from the CVSS vector and Oracle description as authoritative over the tag. Net assessment: a genuine high priority for any exposed instance because of the pre-auth network vector, tempered by the fact that WebCenter Capture is a niche product and no public exploitation is yet evident. |
| Exploit ScenarioDerived | An attacker who can reach the WebCenter Capture server's WebLogic T3 or IIOP listen port sends a crafted serialized object over the protocol without any credentials, triggering server-side processing that leads to full compromise of the application server. No public exploit is identified at time of analysis, but given AC:L/PR:N/UI:N the barrier to a working exploit against a reachable instance is low once technical details or a POC emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch-available-per-vendor-advisory, but Oracle CPUs ship cumulative bundle patches rather than a single tagged release, so an exact fixed build number is not independently confirmed in the input and should be taken from the CPU patch matrix for your platform. Until patching, reduce exposure of the T3/IIOP attack surface: restrict access to the WebLogic listen port (commonly 7001) so only trusted management hosts can reach T3/IIOP, using network ACLs, firewalls, or a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow-list T3/T3S/IIOP by source - noting this can break legitimate remote clients or clustering if over-restricted. Where remote T3/IIOP is not required, disable or block the IIOP protocol and terminate external T3 at a proxy, and keep the capture server off the public internet entirely. These are compensating controls only; the Oracle CPU patch is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Enterprise Capture is a document imaging and capture module of Oracle Fusion Middleware that runs on the Oracle WebLogic Server stack; the affected 'Client Bundle' component and the named T3 and IIOP protocols are WebLogic's proprietary RMI transport protocols used for remote EJB/JMX and object communication. Vulnerabilities reachable over T3/IIOP in the Oracle/WebLogic ecosystem are historically rooted in unsafe Java object deserialization (CWE-502) exposed on the listen port, though the official CWE here is listed as N/A and Oracle does not disclose root-cause internals in its Critical Patch Update advisories. Because these protocols are handled before application-level authentication in many configurations, a crafted serialized object stream delivered to the WebLogic listen port (default 7001, or the configured T3/IIOP port) is the classic path to remote code execution and full server takeover.
Know when Webcenter Enterprise Capture gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated T3/IIOP network vector with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full product takeover, so C/I/A all High and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing unauthenticated remote attackers to completely compromise affected systems via T3/IIOP protocol exploitation. Organizations running these versions face total loss of data confidentiality, integrity, and availability across their content capture infrastructure with no vendor patch currently available. Immediate network isolation and access controls are essential to mitigate this high-risk threat.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict T3/IIOP protocol network access to authorized systems only via firewall rules and segmentation; disable T3/IIOP protocols if not required for business operations; isolate affected WebCenter instances on network segments with minimal external trust relationships; deploy intrusion detection and logging to monitor for suspicious RMI deserialization activity on affected ports.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Enterprise Capture
View allFull takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle co
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-p
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privi
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-bas
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) al
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-p
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achie
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects support
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthent
Exploit-DB