CVE-2026-46781: Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle)

Synopsis

A remote code execution vulnerability exists in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is reachable over the network via RMI (Remote Method Invocation, a Java inter-process communication protocol) with no authentication required and no user interaction needed, and the CVSS scope change indicates that a successful attack can spill beyond the compromised process into adjacent systems. Successful exploitation gives an attacker full takeover of the affected installation, including complete read, write, and availability control, and the scope change means neighboring services or containers are also at risk. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle WebCenter Enterprise Capture RMI service over the network; any host with TCP connectivity to the exposed port is in scope.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable RMI endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or operator of the affected system.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable without needing to satisfy race conditions, guess memory layouts, or meet any special environmental prerequisites.

Blast Radius

• The attacker gains full read access to all data processed or stored by Oracle WebCenter Enterprise Capture, including captured documents, metadata, and stored credentials.
• The attacker can write or modify any data within the application, including altering captured content, injecting malicious records, or overwriting configuration.
• The attacker can crash or indefinitely disable the Oracle WebCenter Enterprise Capture service, halting document capture workflows.
• Because the CVSS scope is changed, the attacker can pivot from the compromised Capture process into adjacent services or containers sharing the same host or network segment, extending control beyond the initial target.