Oracle WebCenter Capture EUVD-2026-46851

Exploitation requires network access to the Oracle WebLogic T3 or IIOP protocol endpoints exposed by the WebCenter Enterprise Capture Client Bundle component (typically WebLogic ports 7001/7002), plus a low-privilege authenticated context, as indicated by PR:L in the CVSS vector - it is NOT anonymous/unauthenticated. Affected deployments are Capture 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce real-world risk: the attacker must be able to reach T3/IIOP (often internal-only in hardened deployments) and must already hold some low-level access; no user interaction is required. Where T3/IIOP are firewalled to management hosts or disabled for external clients, remote exploitation is substantially constrained.

This is a genuine high priority, not an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines network reachability, low complexity, no user interaction, and only a low privilege requirement to achieve total compromise with a scope change - Oracle explicitly labels it 'easily exploitable.' The one gating factor is PR:L: the attacker needs some low-level authenticated foothold or valid credential to the WebLogic/T3 surface, so it is not purely anonymous. No EPSS score, KEV entry, or POC was provided, so probabilistic and observed-exploitation signals are absent; the assessment rests on the CVSS vector and Oracle's own text. There is no SSVC decision data in the input. Treat the missing EPSS/KEV as unknown rather than reassuring - WebLogic T3/IIOP flaws have a strong historical track record of being weaponized quickly once details circulate, so patch on Oracle's July 2026 CPU cycle without waiting for exploit confirmation.

An attacker who has obtained any low-privileged credential or foothold that can open a T3 or IIOP connection to the WebLogic instance hosting WebCenter Capture sends a crafted remote invocation to the Client Bundle component. With low complexity and no user interaction, the request drives the server to full compromise, and because the scope changes, the attacker can extend impact into other Fusion Middleware resources sharing that runtime. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's 'easily exploitable' characterization.