CVE-2026-35283: Critical severity Oracle Oracle WebCenter Enterprise Capture vulnerability
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Enterprise Capture (component: Client Bundle) so that T3 and IIOP traffic is only allowed from trusted IPs or management networks. Enforce this with firewall rules, network ACLs, or a WAF to block T3 and IIOP access from untrusted networks (including the Internet) and isolate affected instances from general-purpose networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35283?
CVE-2026-35283 has a critical severity rating of 9.9.
How do I fix CVE-2026-35283?
To fix CVE-2026-35283, upgrade to the latest supported versions of Oracle WebCenter Enterprise Capture.
What are the affected versions for CVE-2026-35283?
The affected versions for CVE-2026-35283 are 12.2.1.4.0 and 14.1.2.0.0.
What type of attack vector does CVE-2026-35283 utilize?
CVE-2026-35283 can be exploited by an attacker with low privileges using network access via T3 or IIOP.
What components are impacted by CVE-2026-35283?
CVE-2026-35283 impacts the Client Bundle component of the Oracle WebCenter Enterprise Capture product.