CVE-2026-83006

CVE-2026-83006 is a critical (CVSS 9.1) vulnerability in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a high-privileged attacker who has network access to the product via HTTP, requiring no user interaction. Successful exploitation results in a complete takeover of Oracle WebCenter Enterprise Capture with high impact to confidentiality, integrity, and availability, and due to a scope change the attack may also significantly impact additional products beyond the vulnerable component. Organizations running either affected version in their capture workflows are exposed, though the high-privilege prerequisite limits the attacker pool to compromised or malicious privileged accounts. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no observed in-the-wild exploitation to date.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83006 to both 12.2.1.4.0 and 14.1.2.0.0 deployments, prioritizing any instance reachable over HTTP. Until patched, restrict network access to Enterprise Capture client endpoints and audit privileged accounts for anomalous activity, since exploitation requires high privileges and could cascade to other products via the scope change.