CVE-2026-46779: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A remote code execution vulnerability affects Oracle WebCenter Enterprise Capture (Client Bundle component), versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with a low-privilege account and network access over the T3 protocol can exploit this flaw with no victim interaction required, and the scope change means neighboring services beyond WebCenter itself are also at risk. Successful exploitation results in full takeover of the Oracle WebCenter Enterprise Capture instance, giving the attacker read, write, and denial-of-service capability across the affected system and potentially adjacent products. HarborGuard is tracking the Oracle advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the service over the network via the T3 protocol; internet or internal network exposure is sufficient.

• AuthenticationRequired

  Any low-privilege account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions or specific environmental state beyond network access and a valid low-privilege credential.

Blast Radius

• Reads all data accessible to the WebCenter Enterprise Capture service, including captured documents, metadata, and stored credentials.
• Modifies or deletes persisted capture data and application configuration.
• Crashes or degrades the WebCenter Enterprise Capture service, disrupting document ingestion workflows.
• Pivots to additional products in the same environment due to the CVSS scope change, potentially compromising services that trust the WebCenter instance.