CVE-2026-46782: Critical severity Oracle Oracle WebCenter Enterprise Capture vulnerability
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or otherwise restrict HTTP access to Oracle WebCenter Enterprise Capture. If disabling is not possible, restrict HTTP access to only trusted management hosts or internal networks (e.g., via network ACLs or host-based firewall) to prevent exposure to untrusted networks.
Oracle WebCenter Enterprise Capture (Client Bundle) HTTP access = disabled or restricted to trusted hosts - Compensating control
Place network controls in front of the Oracle WebCenter Enterprise Capture HTTP interface: restrict access with firewall rules or ACLs, require VPN for administrative access, and deploy a web application firewall (WAF) to detect and block exploit attempts over HTTP.
- Operational
If compromise is suspected (the advisory indicates takeover is possible), perform incident response actions: investigate for signs of compromise, rotate credentials and API keys, and rebuild or restore affected systems as appropriate after containment.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46782?
CVE-2026-46782 has a critical severity rating of 9.9.
How do I fix CVE-2026-46782?
The recommended fix for CVE-2026-46782 is to apply the latest security patch provided by Oracle for the affected versions.
What products are affected by CVE-2026-46782?
CVE-2026-46782 affects the Oracle WebCenter Enterprise Capture product in versions 12.2.1.4.0 and 14.1.2.0.0.
Can CVE-2026-46782 be exploited remotely?
Yes, CVE-2026-46782 can be easily exploited by a low privileged attacker with network access via HTTP.
What types of impact does CVE-2026-46782 have?
CVE-2026-46782 can lead to complete compromise of confidentiality, integrity, and availability.