Oracle WebCenter Capture EUVD-2026-61468

Exploitation requires network reachability to the Oracle WebLogic T3 and/or IIOP listener ports fronting the WebCenter Enterprise Capture Client Bundle component; the description explicitly names T3 and IIOP as the attack vectors. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration is required - it is unauthenticated against affected supported versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is exposure: T3/IIOP are commonly restricted to internal or management networks, so instances behind firewalls or connection filters that block these ports are effectively out of reach, whereas internet- or broadly-exposed listeners are directly exploitable.

The signals point to a genuine high priority for exposed instances: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates trivially exploitable, unauthenticated, network-reachable compromise with full confidentiality, integrity, and availability impact. There is no EPSS score, no SSVC decision data, no POC, and no CISA KEV listing in the provided input, so 'confirmed active exploitation' cannot be claimed - this is potential, not observed, exploitation. Note a data inconsistency worth flagging: the Oracle-supplied tag says 'Information Disclosure', yet both the description and CVSS (C:H/I:H/A:H, 'takeover') indicate full compromise, not just disclosure - treat the tag as under-stating impact and defer to the CVSS/description. Real-world risk hinges heavily on network exposure: T3/IIOP are typically internal-only ports, so internet-exposed or poorly-segmented deployments are at serious risk while properly firewalled internal instances are lower priority.

An attacker who can reach the WebCenter Capture server's WebLogic T3 or IIOP port sends a crafted remote invocation (e.g., a malicious serialized object) without any credentials, exploiting the Client Bundle to gain code execution and take over the product. Because AC:L and PR:N, no user interaction or prior access is needed; this is most realistic where the T3/IIOP ports are exposed to a broad network segment. No public POC is identified at time of analysis.