CVE-2026-83012

CVE-2026-83012 is an easily exploitable vulnerability in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker who already holds a low-privileged account can trigger the flaw over HTTP to read data the attacker should not be entitled to, up to complete access to all data accessible through Oracle WebCenter Enterprise Capture. Because the CVSS vector indicates a scope change (S:C), successful attacks may also expose data in additional Oracle products beyond Enterprise Capture itself. The bug is confidentiality-only (C:H/I:N/A:N) with a CVSS 3.1 base score of 7.7 (high), and it does not currently appear in CISA's KEV catalog, with no public proof-of-concept known. Organizations running the affected on-premises Fusion Middleware releases should treat any internet-reachable or broadly shared Enterprise Capture deployment as exposed to credential-holding insiders or outsiders.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83012 to all WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 installations, since in-place patching is the only vendor-supported fix. Restrict HTTP access to the Enterprise Capture client and server endpoints to trusted networks and VPN users, and audit low-privileged accounts for anomalous document-batch or repository reads. Because the scope change can spill into other Oracle products, review data accessible via the Capture service account beyond the Capture application itself.