WebCenter Enterprise Capture EUVD-2026-79340

Requires the attacker to already hold a low-privilege authenticated account on Oracle WebCenter Enterprise Capture (PR:L) with network HTTP reachability to the Client Bundle component of versions 12.2.1.4.0 or 14.1.2.0.0. No user interaction is needed (UI:N) and complexity is low (AC:L), but the authentication requirement is the primary limiting factor - this cannot be exploited by a fully unauthenticated actor despite the misleading 'Authentication Bypass' tag. Impact is confidentiality-only (unauthorized read of all Capture-accessible data, with a scope change that may expose data in adjacent Fusion Middleware products); there is no integrity or availability impact. Oracle discloses no specific vulnerable endpoint, parameter, or configuration precondition.

This is a genuinely high-severity data-disclosure issue but not a top-tier crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) is well-calibrated and internally consistent: network-reachable over HTTP, low attack complexity, but requiring at least low-privilege authentication (PR:L), and honestly scoped to confidentiality only (I:N/A:N) - an unusually restrained rating for Oracle, which often inflates to full-triad C:H/I:H/A:H. The scope change (S:C) is what pushes the score above 7, reflecting Oracle's statement that attacks 'may significantly impact additional products.' On the exploitation-signal side there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score is provided in the input, so there is no evidence of active or automated exploitation - this is a patch-in-normal-cycle priority, not a drop-everything emergency. Two data conflicts must be flagged: (1) the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires PR:L (an authenticated attacker), so this is a privileged-user data-disclosure flaw, NOT an authentication bypass; and (2) Oracle's CPU advisory (cspusep2026) provides zero technical detail - no CWE, no endpoint, no affected parameter - so root cause and the precise mechanism of the scope change cannot be verified.

A low-privileged authenticated user of the WebCenter Enterprise Capture Client Bundle sends crafted HTTP requests to the Capture service and, exploiting a scope-changing flaw, reads Capture data beyond their authorization - potentially all Capture-accessible data and data in adjacent Fusion Middleware products. No public exploit code is available and Oracle publishes no technical detail, so a working attack would require reverse-engineering the patch; exploitation is network-based with low complexity once credentials are held.