EUVD-2026-46854
GHSA-v83g-772p-77m8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebLogic T3/IIOP listener
-
DeliverySend crafted client-bundle request
-
ExploitTrigger unauthenticated flaw
-
ExecutionExecute attacker-controlled logic
-
ImpactFull takeover of WebCenter Capture
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the WebLogic T3 (or T3S) or IIOP listener serving Oracle WebCenter Enterprise Capture - these are the exact protocols named as the attack vector. No authentication and no user interaction are required (PR:N/UI:N), and the target must be running affected version 12.2.1.4.0 or 14.1.2.0.0 of the Client Bundle component. The practical limiting factor is exposure of the T3/IIOP port: in deployments where these protocols are firewalled to internal or trusted management networks (a common hardening practice), remote reach is constrained, whereas any environment exposing the WebLogic listen port to untrusted networks is directly exploitable against default configurations. |
| Impact | Every automated signal points to top-tier priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8, meaning network-reachable, low-complexity, unauthenticated exploitation with full triad impact, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability and in-the-wild signals cannot be confirmed - absence of KEV means it is not yet known-exploited, not that it is safe. One conflict to note: the intelligence tag reads 'Information Disclosure,' which understates the CVSS I:H/A:H and Oracle's 'takeover' language; the tag appears to be a partial or mislabeled classification and should not be trusted over the CVSS vector and Oracle's own wording. The main real-world limiter is network exposure of T3/IIOP, which is often restricted to internal or trusted segments rather than the public internet. |
| Exploit ScenarioDerived | An attacker who can reach the WebLogic T3 or IIOP listener sends a crafted request to the WebCenter Capture Client Bundle component without any credentials, triggering the flaw to gain full control of the application. Given Oracle's 'easily exploitable / takeover' description and the AC:L/PR:N/UI:N vector, exploitation requires no user interaction and no authentication, though no public POC has been observed yet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; Oracle CPUs do not publish a separate fixed build string in the CVE record, so validate the exact patch/PSU number for your 12.2.1.4.0 or 14.1.2.0.0 deployment against the CPU matrix). Because the vector is T3/IIOP, the highest-value compensating control is to restrict those protocols: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3S/IIOP from untrusted networks, and place the managed server behind a firewall that blocks the WebLogic listen port (commonly 7001/7002) from the internet and any untrusted segment - the trade-off is that legitimate remote RMI/EJB clients and some management tooling that rely on T3/IIOP will break and must be explicitly allow-listed. Disabling IIOP in the server configuration where it is unused further reduces the surface with minimal impact. These controls reduce exposure but are not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebCenter Enterprise Capture is a document imaging and capture application built on the Oracle WebLogic Server / Fusion Middleware stack. The affected 'Client Bundle' component is reached via T3 and IIOP - WebLogic's proprietary RMI transport protocols used for remote EJB and JNDI operations. These protocols are a long-standing WebLogic attack surface because they deserialize Java objects sent by remote clients; historically, T3/IIOP exposure has enabled Java deserialization gadget chains leading to remote code execution. Oracle did not assign a CWE (listed N/A) and does not publish root-cause detail, but the T3/IIOP vector combined with a full-takeover outcome is consistent with an unauthenticated remote code execution or unsafe deserialization class of bug rather than mere information disclosure.
Know when Webcenter Enterprise Capture gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network exploitation over T3/IIOP with low complexity and no user interaction, yielding full application takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote code execution, allowing attackers to achieve complete system takeover without requiring credentials, creating an immediate risk of total infrastructure compromise and data loss for any organization running these versions. No vendor patch is currently available, forcing reliance on interim network controls to prevent exploitation. Organizations must identify and isolate affected systems immediately or face critical exposure to breach, operational disruption, and regulatory penalties.
No vendor-released patch identified at time of analysis. Interim mitigations include: implement strict firewall rules to block unauthorized inbound access to T3 and IIOP protocol ports, restricting connections to known-trusted systems only; disable T3 and IIOP protocols entirely if not required for business operations; isolate affected WebCenter systems from production networks and sensitive data stores via network segmentation; deploy intrusion prevention signatures for exploitation attempts; enable comprehensive logging and alerting on all connections to these protocol ports; restrict administrative access and enforce multi-factor authentication for any remaining connections to affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Webcenter Enterprise Capture
View allFull takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle co
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-p
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privi
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-bas
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) al
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-p
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achie
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects support
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthent
Exploit-DB