CVE-2026-46778: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A critical remote code execution vulnerability affects the Client Bundle component of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware. An unauthenticated attacker with network access can reach the service over RMI (Remote Method Invocation, a Java inter-process communication protocol) and exploit it without any credentials or victim interaction. Successful exploitation results in a full takeover of the affected product, with impact spilling into adjacent systems due to a scope change in the CVSS rating. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Enterprise Capture service over the network via the RMI protocol; internet or internal network exposure is sufficient.

• AuthenticationNot required

  No credentials of any kind are required; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely against the exposed service.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable with no dependency on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Reads all data accessible to the Oracle WebCenter Enterprise Capture process, including captured documents, metadata, and stored credentials.
• Modifies or destroys persisted capture workflows, document repositories, and configuration data.
• Crashes or fully disables the Oracle WebCenter Enterprise Capture service, halting document ingestion pipelines.
• Due to scope change, compromises additional products and services that share the same host or trust the Capture service, extending attacker control beyond the initial target.