WebCenter Enterprise Capture EUVD-2026-46843

Exploitation requires network access to the Oracle WebCenter Enterprise Capture Client Bundle HTTP interface and a low-privileged authenticated foothold (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special non-default configuration is indicated by Oracle beyond running an affected version (12.2.1.4.0 or 14.1.2.0.0) with the Capture endpoint reachable by the attacker. The limiting factors that reduce real-world exposure are the requirement for some valid low-privilege credentials/session and network reachability of the Capture HTTP endpoint; environments that isolate Capture behind internal networks and enforce least-privilege accounts materially raise the bar. The scope change (S:C) means a successful attack is not confined to Capture and may impact additional integrated products.

The signals point to genuine high priority rather than inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with total confidentiality/integrity/availability impact and a scope change - Oracle itself labels it 'easily exploitable.' No EPSS score was provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC is referenced, so this is not confirmed active exploitation - the risk is driven by the intrinsic ease of exploitation and the total impact, not by observed attacks. One tension worth noting: the assigned tags include 'Information Disclosure,' which understates the vector, since the CVSS shows full I and A impact plus takeover, not merely disclosure - treat the tag as incomplete triage metadata rather than the true impact ceiling. The PR:L requirement (some authenticated foothold) is the main limiting factor separating this from a fully unauthenticated internet worm scenario.

An attacker who holds or phishes a low-privileged Oracle WebCenter Enterprise Capture account reaches the Client Bundle over HTTP and sends a crafted request that abuses the vulnerable component to escalate to full control of the Capture application. Because of the scope change, the attacker then pivots from Capture into adjacent Fusion Middleware content resources, achieving takeover with full read/write and service-disruption capability. No public exploit code is referenced, so this reflects the low-complexity path Oracle describes rather than an observed campaign.