Webcenter Enterprise Capture
Monthly
Unauthenticated HTTP exploitation of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can lead to full takeover of the application. The vulnerability resides in the Client Bundle component and is easily exploitable over the network without credentials. No public exploit or CISA KEV listing was identified in the provided data.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.
High-privileged users with network access can take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through the Client Bundle component, yielding full confidentiality, integrity and availability impact plus a scope change (S:C) that lets a compromise of Capture reach beyond that component into other Fusion Middleware resources. The underlying issue is an improper access control weakness (CWE-284) rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); the PR:H prerequisite is the principal limiting factor, so this is not triggerable by an anonymous or low-privileged remote attacker, and no user interaction is required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is low at 0.46% (39th percentile), so this is a high-severity, low-likelihood-of-opportunistic-exploitation issue that primarily matters to environments where privileged accounts are shared, weakly governed, or externally reachable.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.
Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthenticated HTTP exploitation of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can lead to full takeover of the application. The vulnerability resides in the Client Bundle component and is easily exploitable over the network without credentials. No public exploit or CISA KEV listing was identified in the provided data.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privilege authenticated user with HTTP access to the Client Bundle component to read all data accessible to the Capture application, and - because the vulnerable component crosses a security scope boundary - potentially reach data in adjacent Oracle Fusion Middleware products. The flaw is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is confidentiality-only, with no integrity or availability impact; exploitation requires an existing low-privilege account, so despite being tagged 'Authentication Bypass' in threat-intelligence feeds, this is not reachable by a fully unauthenticated actor. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and lack of user interaction make it attractive for post-authentication data theft against internet-exposed Capture deployments.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Low-privileged authenticated users with network access can exploit a flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 to read critical data and modify records, with the impact extending beyond the vulnerable product itself (scope change). Oracle rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), driven by high confidentiality impact and cross-component scope change rather than by availability or integrity loss. No public exploit code and no evidence of active exploitation were identified at time of analysis, and no EPSS or CISA KEV data was supplied with the source material.
High-privileged users with network access can take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through the Client Bundle component, yielding full confidentiality, integrity and availability impact plus a scope change (S:C) that lets a compromise of Capture reach beyond that component into other Fusion Middleware resources. The underlying issue is an improper access control weakness (CWE-284) rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); the PR:H prerequisite is the principal limiting factor, so this is not triggerable by an anonymous or low-privileged remote attacker, and no user interaction is required. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is low at 0.46% (39th percentile), so this is a high-severity, low-likelihood-of-opportunistic-exploitation issue that primarily matters to environments where privileged accounts are shared, weakly governed, or externally reachable.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
A difficult-to-exploit flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture (12.2.1.4.0 and 14.1.2.0.0) lets an attacker who already holds a low-privileged logon on the host compromise the application, reading and altering critical capture data and potentially affecting interconnected downstream products through a scope change. Exploitation is not trivial: it requires local access, a low-privileged account, high attack complexity, and a second user to perform an interaction. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; Oracle's Critical Security Patch Update advisory is the authoritative source.
Improper authorization on the SOAP-facing Client Bundle interface of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-positioned attacker read all data the application can reach and modify a subset of it. Oracle scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and the Changed scope metric indicates the blast radius can extend beyond Capture into other Fusion Middleware components. No public exploit code or CISA KEV entry was identified at time of analysis; the Oracle Critical Security Patch Update advisory (cspusep2026) is the authoritative source.
Complete takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over the T3 and IIOP protocols in the Client Bundle component. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects easy, network-based exploitation yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Remote unauthenticated compromise of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) allows an attacker with only network/HTTP reach to create, delete, or modify critical data, read a subset of accessible data, and cause partial denial of service. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle explicitly flags a scope change meaning successful attacks may significantly impact other products beyond Capture itself. Rated CVSS 3.1 9.9; disclosed in the Oracle Critical Patch Update of August 2026 with no public exploit identified at time of analysis.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture is possible when a low-privileged, network-authenticated attacker abuses a flaw in the Client Bundle component reachable over HTTP, resulting in complete takeover with high confidentiality, integrity, and availability impact. It affects Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. Oracle rates it easily exploitable (CVSS 8.8), with no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker with network access over HTTP targets the Client Bundle component. Per Oracle's July 2026 Critical Patch Update, successful attacks result in complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.