What is the CVSS score of EUVD-2026-47303?

EUVD-2026-47303 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Webcenter Enterprise Capture are affected by EUVD-2026-47303?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical remote code execution vulnerability enabling complete system takeover without authentication.

How to fix or mitigate EUVD-2026-47303?

Within 24 hours, identify all systems running Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 or 14.1.2.0.0 and segment network access to these systems. Within 7 days, implement network-based controls (WAF rules, IP whitelisting, VPN-only access) to restrict HTTP access to the Client Bundle component from untrusted networks, and enable enhanced logging on affected systems. Within 30 days, develop and execute an upgrade plan to Oracle WebCenter Enterprise Capture version 14.2 or later, prioritizing systems with direct internet exposure.

Webcenter Enterprise Capture EUVD-2026-47303

| CVE-2026-61092 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p424-v8vj-cp4j

Authentication Bypass Oracle Webcenter Enterprise Capture

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:52 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.