What is the CVSS score of EUVD-2026-46852?

EUVD-2026-46852 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Webcenter Enterprise Capture are affected by EUVD-2026-46852?

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete platform compromise via low-privileged network access, with blast radius extending to dependent…

How to fix or mitigate EUVD-2026-46852?

Within 24 hours: Identify all systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 and immediately block external access to T3 and IIOP protocols via firewall rules; restrict these protocols to authorized internal systems only. Within 7 days: Complete inventory of all dependent Oracle Fusion Middleware components connected to affected Capture instances; engage your Oracle account team to confirm patched version timelines and obtain upgrade roadmap; deploy detailed logging and alerting for authentication failures and privilege escalation on affected systems. Within 30 days: Execute tested migration to patched Capture version upon vendor release; if upgrade is delayed, formally approve and document compensating controls (network segmentation, access restrictions, monitoring) as interim security measures and provide leadership with remediation timeline.

Webcenter Enterprise Capture EUVD-2026-46852

| CVE-2026-60458 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-wqp7-8mjr-xcxm

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:03 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.