CVE-2026-35284: Critical severity Oracle Oracle WebCenter Enterprise Capture vulnerability
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle WebCenter Enterprise Capture (component: Client Bundle) by blocking or allowing only trusted IPs for T3 and IIOP protocols/ports at the network perimeter (firewalls/ACLs/WAF). The vulnerability is exploitable via T3 and IIOP, so deny these protocols from untrusted networks.
- Compensating control
Isolate any instances running the affected supported versions (12.2.1.4.0 and 14.1.2.0.0) from untrusted networks — place them on a management VLAN, remove direct Internet access, and restrict administrative access to a minimal set of trusted hosts until a vendor fix is available.
- Operational
If any Oracle WebCenter Enterprise Capture instance (including versions 12.2.1.4.0 or 14.1.2.0.0) was exposed or suspected compromised, perform incident response: immediately isolate the host(s), acquire forensic images, rotate any credentials and keys used by the affected systems, rebuild services from known-good images, and only restore connectivity after remediation steps are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35284?
The severity of CVE-2026-35284 is critical, rated at 9.9 on the CVSS scale.
How do I fix CVE-2026-35284?
To mitigate CVE-2026-35284, users should apply the latest security patches provided by Oracle for affected versions.
What systems are affected by CVE-2026-35284?
CVE-2026-35284 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0.
What type of attack can exploit CVE-2026-35284?
CVE-2026-35284 can be exploited by a low privileged attacker remotely through T3 and IIOP protocols.
Is CVE-2026-35284 easily exploitable?
Yes, CVE-2026-35284 is classified as easily exploitable, allowing low privileged access to compromise systems.