Oracle WebCenter Capture EUVD-2026-61474

The attacker must have network reachability to the Oracle WebCenter Enterprise Capture service's Java RMI interface (the Client Bundle component); per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no elevated privileges, and no user interaction are required against affected default deployments of versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is therefore network exposure of the RMI listener: environments that firewall RMI ports to trusted hosts, segment the service, or keep it off untrusted networks materially raise the bar, since the vector depends on an attacker being able to open an RMI connection to the target.

This is a genuine high-priority issue, not a paper-tiger high score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H shows network attack vector, low complexity, no privileges, and no user interaction, and Oracle itself labels it 'easily exploitable' with a result of product takeover. No EPSS score, KEV entry, or POC signal was provided, so exploitation-in-the-wild cannot be asserted - the risk here is driven by the intrinsic severity and the low barrier to attack rather than by observed activity. Because RMI-reachable enterprise middleware is often exposed on internal networks (and sometimes carelessly to the internet), any operator running an affected build should treat this as urgent and patch on Oracle's CPU cadence even absent a public exploit. The main open question is real-world exposure: the impact is unambiguous, but without EPSS or KEV data the probability of near-term mass exploitation is unquantified and should be re-checked as Oracle CPU details propagate.

An attacker who can reach the WebCenter Capture RMI service over the network sends a crafted RMI request/serialized payload to the Client Bundle interface, requiring no credentials and no user interaction. Successful processing yields full compromise of the WebCenter Capture instance - confidentiality, integrity, and availability of captured documents and the service itself. No public proof-of-concept was identified in the provided data, so this scenario is derived from the CVSS vector and Oracle's 'easily exploitable / takeover' description.