What is the CVSS score of EUVD-2026-46850?

EUVD-2026-46850 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by EUVD-2026-46850?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) faces critical risk of account takeover and unauthorized access with no vendor patch currently available and potential impact…

How to fix or mitigate EUVD-2026-46850?

Within 24 hours, identify all systems running Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 and implement firewall rules to restrict HTTP access to essential administrative users only, removing public or unrestricted network access. Within 7 days, deploy network segmentation to isolate affected WebCenter systems from sensitive data repositories and adjacent infrastructure, activate enhanced monitoring for authentication anomalies, and initiate contact with Oracle support to confirm patch timeline and interim guidance. Within 30 days, execute the upgrade plan to a patched version when available, or complete an emergency upgrade to an unaffected version if business continuity requires remediation before a security patch is released.

Oracle WebCenter Capture EUVD-2026-46850

| CVE-2026-60456 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5jjw-x6w2-c9j2

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Low-privilege authenticated HTTP access yields PR:L/AV:N/AC:L; documented scope change to other products gives S:C; full takeover justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:02 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-imaging and batch-capture platform within the Oracle Fusion Middleware stack, used to scan, index, and ingest documents into ECM/content repositories. The flaw sits in the Client Bundle component, the client-side/browser-delivered code used to drive capture workflows over HTTP. Oracle assigns no CWE (CWE: N/A) and does not disclose the root-cause class publicly, consistent with its coordinated Critical Patch Update process; the scope-change flag (S:C in the CVSS vector) indicates the vulnerable component can affect resources beyond its own security authority - typical of a middleware component whose compromise cascades into integrated content-management or identity services. Affected CPE-equivalent products are Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering this CVE; the input does not enumerate an exact patched build number, so treat this as 'Patch available per vendor advisory' and pull the specific patch corresponding to your 12.2.1.4.0 or 14.1.2.0.0 deployment from My Oracle Support. Prioritize patching because the flaw allows low-privileged full takeover with scope change. Until the CPU patch is applied, reduce exposure with concrete compensating controls: restrict HTTP access to the Capture Client Bundle endpoints to trusted management networks or via VPN/reverse-proxy allowlists (trade-off: may break remote scanning-station clients); tighten account provisioning and revoke unnecessary low-privilege Capture accounts, since PR:L means any such account is an attack vector; and increase monitoring of Capture and integrated content/identity services for anomalous privilege use given the scope-change impact. Because Oracle CPU fixes are cumulative, verify no prerequisite bundle patch level is missing before applying.