What is the CVSS score of EUVD-2026-46853?

EUVD-2026-46853 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by EUVD-2026-46853?

Oracle WebCenter Enterprise Capture poses an immediate critical risk to document processing operations and connected business systems.

How to fix or mitigate EUVD-2026-46853?

Within 24 hours: Inventory all Oracle WebCenter Enterprise Capture instances (Fusion Middleware Client Bundle component) and map data flows to dependent systems; restrict HTTP access to administrative users only through network controls, reverse proxy authentication, or firewall ACLs; isolate any internet-facing instances immediately. Within 7 days: Deploy Web Application Firewall rules specifically for Oracle WebCenter Enterprise Capture to block anomalous requests; audit and enforce strict controls on all low-privilege user accounts; enable comprehensive logging at both application and network layers with automated alerting for suspicious authentication or privilege escalation attempts. Within 30 days: Maintain heightened monitoring protocols pending Oracle's patch release for CVE-2026-60459; coordinate with Oracle for patch availability and establish expedited deployment procedures; conduct cost-benefit analysis of alternative document capture platforms if patch timeline extends beyond 60 days.

Oracle WebCenter Capture EUVD-2026-46853

| CVE-2026-60459 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mq5m-mq99-mcmc

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP, low complexity, and a required low-privilege account give AV:N/AC:L/PR:L/UI:N; Oracle-stated scope change with full takeover yields S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:03 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.

Technical ContextAI

Oracle WebCenter Enterprise Capture is an enterprise document-imaging and batch-capture platform within the Oracle Fusion Middleware stack, used to scan, index, and ingest documents into content management systems such as Oracle WebCenter Content. The affected element is the 'Client Bundle' component, the client-facing tier reached over HTTP. The advisory does not assign a CWE (listed as N/A), so the precise root-cause class is unstated; however, the combination of scope change (S:C) and full confidentiality/integrity/availability impact is consistent with an authenticated request-handling flaw that lets a low-privileged user break out of the application's security authority and affect other components. Because it is Java-based Fusion Middleware, a compromise of the Capture tier typically also exposes credentials and integrations to downstream content-management back ends.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update, which is the vendor-released remediation for both affected releases; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle mapped to your 12.2.1.4.0 or 14.1.2.0.0 deployment and apply it during your next emergency maintenance window (no exact fixed build number is enumerated in the supplied data, so pull the precise patch ID from the CPU matrix). Oracle CPU issues do not typically ship standalone workarounds, so if immediate patching is impossible, apply compensating controls: restrict HTTP access to the Capture Client Bundle endpoints to trusted management networks or VPN only via network ACLs or a reverse-proxy allowlist (trade-off: may block legitimate remote scanning clients), tighten account provisioning so the 'low privilege' accounts required for exploitation are minimized and monitored, and increase logging/alerting on the Capture tier. These controls reduce exposure but are not a substitute for the CPU patch given the scope-change impact.