WebCenter Enterprise Capture EUVD-2026-61284

Exploitation requires network access to Oracle WebCenter Enterprise Capture's WebLogic T3 or IIOP remoting listener (the description names these two protocols explicitly as the vector); the affected build must be 12.2.1.4.0 or 14.1.2.0.0 with the Client Bundle component present. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special non-default configuration are needed - this is unauthenticated exploitation of a standard deployment. The primary practical limit on exploitation is reachability of the T3/IIOP ports: if those listeners are firewalled to trusted hosts or not exposed beyond an internal segment, the remote attack surface is correspondingly reduced.

This should be treated as a top-priority, patch-immediately issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and Oracle itself flags it 'easily exploitable' with full C/I/A impact - the combination that historically translates into wormable or scan-and-exploit activity against internet- or intranet-exposed WebLogic services. Counter-signals temper the raw score: there is no public exploit identified at time of analysis, it is not in CISA KEV, and no EPSS probability was provided in the input, so widespread active exploitation is not yet evidenced. Any operator running an affected version - from a large enterprise to a mid-sized municipal IT team - should treat this as urgent, because the T3/IIOP surface is frequently exposed on internal networks and is a well-trodden exploitation path even when a specific PoC has not yet gone public. One inconsistency to note for triage: the intelligence tag labels this 'Information Disclosure,' which conflicts with Oracle's 'takeover' language and the I:H/A:H impacts - the tag understates the true severity and should not be used to downgrade prioritization.

An attacker with network reachability to the WebLogic T3 or IIOP listener sends a single crafted remoting request carrying a malicious serialized payload to the WebCenter Enterprise Capture Client Bundle endpoint, requiring no credentials and no user interaction. The server processes the object and the attacker gains code execution, leading to complete takeover of the Capture instance and the documents it holds. No public exploit is identified at time of analysis, but the low attack complexity means weaponization is straightforward once a gadget chain is identified.