Description

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-07-21T22:18:41.140Z",
  "pubdate": "2026-07-21T22:18:41.140Z",
  "executiveSummary": "This vulnerability affects the Client Bundle component of Oracle WebCenter Enterprise Capture, specifically versions 12.2.1.4.0 and 14.1.2.0.0.\nThe vulnerability is classified as a critical-severity flaw, as indicated by a CVSS 3.1 Base Score of 9.8.\nIt allows an unauthenticated, remote attacker with network access to execute unauthorized commands or functions via the HTTP protocol.\nSuccessful exploitation results in a complete system compromise, granting the attacker full control over the Oracle WebCenter Enterprise Capture application, impacting the confidentiality, integrity, and availability of the system.\nGiven that the vulnerability requires no authentication and can be triggered via standard network requests, the risk profile is extremely high, requiring immediate attention and remediation.",
  "technicalDetails": "The vulnerability resides within the Client Bundle component of Oracle WebCenter Enterprise Capture. The flaw facilitates a full-system takeover by exploiting weak or missing authentication controls within the HTTP-based request processing mechanism.\nThe attack vector is characterized as Network (AV:N), meaning the vulnerability can be reached remotely without physical or local access. The attack complexity is low (AC:L), indicating that the flaw is easily exploitable and does not require complex conditions or specialized race conditions to trigger. The attack does not require any user interaction (UI:N) or prior authentication (PR:N), allowing any entity with network reach to the target to initiate the exploit.\nThe attack flow involves an attacker crafting a specific HTTP request targeting the vulnerable endpoints managed by the Client Bundle. Because the component lacks robust validation or authentication enforcement, the malicious payload is processed directly by the application's underlying framework.\nUpon successful execution, the payload bypasses existing security boundaries, allowing the attacker to perform arbitrary operations under the context of the application's service account. This post-exploitation state provides the attacker with administrative privileges, which can be leveraged to exfiltrate sensitive data, modify system configurations, or deploy persistent malicious artifacts within the Oracle Fusion Middleware environment.\nThe scope of the impact is comprehensive, affecting all three pillars of the CIA triad (Confidentiality, Integrity, and Availability). Because the vulnerability resides in the application layer of the Oracle WebCenter Enterprise Capture product, the impact is localized to the application's data and operational environment. However, since the product interacts with backend repositories and middleware infrastructure, the compromise can potentially facilitate lateral movement or further exploitation within the broader enterprise middleware ecosystem.\nThe vulnerability is present in versions 12.2.1.4.0 and 14.1.2.0.0. The lack of architectural hardening in the Client Bundle component regarding external input handling serves as the primary root cause for this critical vulnerability."
}