CVE-2026-83339

Oracle WebCenter Enterprise Capture, a component of Oracle Fusion Middleware, contains an easily exploitable flaw in its Client Bundle that allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful attacks can result in a complete takeover of the Enterprise Capture instance, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Affected installations run versions 12.2.1.4.0 or 14.1.2.0.0. No public proof-of-concept or confirmed in-the-wild exploitation is known and the CVE is not on the CISA KEV list, but the unauthenticated, low-complexity network vector makes any internet-reachable deployment a high-value target.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83339 to all deployments of WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0. Until patched, restrict HTTP access to the Enterprise Capture client endpoints via VPN or IP allowlisting and monitor for unauthenticated or anomalous requests. Verify whether your Fusion Middleware estate includes WebCenter Enterprise Capture, as this niche component is often missed in WebLogic-focused patch reviews.