CVE-2026-35281: Critical severity Oracle WebCenter Enterprise Capture vulnerability
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Oracle WebCenter Enterprise Capture (Client Bundle) instances running versions 12.2.1.4.0 or 14.1.2.0.0, restrict network access to the T3 and IIOP protocols: block or deny inbound T3/IIOP traffic at network perimeter firewalls, host-based firewalls, and ACLs, or isolate affected servers from untrusted networks to prevent network access via T3/IIOP.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35281?
The severity of CVE-2026-35281 is critical, with a score of 9.9.
How do I fix CVE-2026-35281?
To fix CVE-2026-35281, ensure you update Oracle WebCenter Enterprise Capture to the latest patched version.
What systems are affected by CVE-2026-35281?
CVE-2026-35281 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0.
What types of access does CVE-2026-35281 allow?
CVE-2026-35281 allows low privileged attackers with network access via T3 and IIOP to compromise the system.
What components of Oracle Fusion Middleware are impacted by CVE-2026-35281?
The affected component in CVE-2026-35281 is the Client Bundle of Oracle WebCenter Enterprise Capture.