Oracle WebCenter Capture EUVD-2026-46855

Exploitation requires network reachability to the Oracle WebLogic T3 or IIOP listener fronting WebCenter Enterprise Capture, plus a low-privileged authenticated foothold (CVSS PR:L) - the attacker must already possess some valid low-level access, not merely anonymous network reach. Affected deployments are specifically versions 12.2.1.4.0 and 14.1.2.0.0 running the Client Bundle component. Limiting factors that reduce real-world exposure: the PR:L authentication requirement, and any environment where T3/IIOP are firewalled or disabled to untrusted networks removes the delivery channel; conversely, no user interaction and low attack complexity mean that once those conditions are met, exploitation is straightforward per Oracle's own 'easily exploitable' characterization.

All confirmed signals point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, yielding total compromise plus scope change - hence the 9.9 score, one of the highest in the July 2026 CPU. Oracle explicitly characterizes it as 'easily exploitable.' However, exploitation is not unauthenticated: PR:L means the attacker must already hold some valid low-level access, which meaningfully narrows the exposed population versus a PR:N flaw. Countervailing the raw score: this is not in CISA KEV, no EPSS score was supplied, and no POC is referenced, so there is no evidence of active exploitation - the risk is high potential impact rather than confirmed in-the-wild activity. The 'Information Disclosure' tag is narrower than the description's full CIA takeover; treat the description/CVSS as authoritative over the tag. Net: patch on Oracle's expedited timeline given the CVSS and T3/IIOP exposure, but the low-privilege prerequisite and absence of exploitation evidence place it just below drop-everything emergency.

A low-privileged user (or an attacker who has phished/obtained a low-level Capture credential) connects to the WebLogic-exposed T3 or IIOP listener over the network and sends a crafted remote invocation to the vulnerable Client Bundle component. Because attack complexity is low and no user interaction is needed, the request escalates the attacker to full control of WebCenter Enterprise Capture, and the scope change lets the compromise reach co-hosted Fusion Middleware resources. No public POC is referenced at time of analysis.