CVE-2026-83007

A high-severity vulnerability (CVSS 3.1 base score 8.5) in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware, is easily exploitable by a low-privileged authenticated attacker with network access via HTTP. The flaw involves a scope change, meaning successful attacks on WebCenter Enterprise Capture can significantly impact additional products beyond the vulnerable component. A successful attacker gains unauthorized access to critical data or complete read access to all Oracle WebCenter Enterprise Capture accessible data, as well as unauthorized update, insert, or delete access to some of that data; availability is not impacted. Affected deployments are those running versions 12.2.1.4.0 or 14.1.2.0.0. The vulnerability is not on the CISA KEV list, no public proof-of-concept is known, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update (CPU) that fixes CVE-2026-83007 to WebCenter Enterprise Capture servers and any redistributed Client Bundle components on 12.2.1.4.0 or 14.1.2.0.0. Restrict HTTP access to Capture client and server endpoints to trusted users and networks, and review the privileges granted to low-privileged Capture accounts. Review audit logs for anomalous document reads or modifications by low-privilege users that could indicate attempted abuse.