Oracle WebCenter Capture EUVD-2026-47310

Exploitation requires network HTTP access to the Oracle WebCenter Enterprise Capture Client Bundle component plus a valid low-privileged account (CVSS PR:L), so it is not anonymously exploitable against a default install without credentials. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning any authenticated low-privilege user who can reach the Capture HTTP interface can attempt it. Affected deployments are limited to Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 running the Client Bundle component; the primary limiting factors are the authentication requirement and network reachability of the Capture interface.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8 (High): network vector, low attack complexity, no user interaction, only low privileges required, and full triple impact. This is a genuine prioritization concern because exploitation is easy and needs only a valid low-privileged account, which is common in enterprise document-capture deployments with many end users. However, no EPSS score, SSVC decision, POC, or KEV data was provided, so real-world exploitation likelihood cannot be quantified from the input. The PR:L requirement meaningfully limits fully anonymous internet-wide exploitation, distinguishing this from a PR:N pre-auth bug; practical risk is highest where the Capture client interface is broadly accessible to internal or partner users. No conflict exists between the vector and the description - both agree on network, low-privilege, high-impact takeover.

An attacker who holds or phishes a low-privileged Oracle WebCenter Capture account authenticates to the Capture client interface and sends a crafted HTTP request to the Client Bundle component. Because attack complexity is low and no user interaction is needed, the request escalates the attacker's access and results in full takeover of the Capture application, exposing and altering captured documents. No public exploit code was identified at time of analysis.