CVE-2026-60458 in WebCenter Enterprise Capture
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle WebCenter Enterprise Capture, a component of Oracle Fusion Middleware that handles document capture and processing workflows. The flaw resides specifically in the Client Bundle functionality and affects two major version lines: 12.2.1.4.0 and 14.1.2.0.0. The vulnerability classification as easily exploitable indicates that attackers with minimal technical expertise can leverage this weakness, making it particularly dangerous for organizations relying on these systems. The attack vector utilizes T3 and IIOP protocols, which are legacy communication mechanisms commonly used for Java-based enterprise applications, suggesting that the vulnerability stems from inadequate protocol handling or authentication mechanisms within the webcenter capture framework.
The technical nature of this flaw allows a low privileged attacker to gain unauthorized access to the Oracle WebCenter Enterprise Capture system through network connections. This represents a significant security gap in the application's access controls and authentication mechanisms, as it permits attackers with minimal privileges to escalate their access level. The vulnerability's impact extends beyond the immediate target system due to its potential for scope change, meaning that successful exploitation could compromise additional Oracle products within the same enterprise environment. This cascading effect demonstrates how vulnerabilities in one component can create broader security implications across an organization's IT infrastructure.
The CVSS 3.1 base score of 9.9 indicates a critical severity level with high impacts across all three core security principles: confidentiality, integrity, and availability. The attack requires network access via T3 or IIOP protocols which are typically exposed on standard ports within enterprise environments, making them readily accessible to potential attackers. The vector notation CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H clearly indicates that the vulnerability is remotely exploitable with low access complexity, requires only low privilege level access, does not require user interaction, and can cause a scope change affecting additional systems while simultaneously compromising all three security aspects. This assessment aligns with CWE-284 (Improper Access Control) and potentially CWE-310 (Cryptographic Issues) depending on the specific implementation details of the authentication mechanisms.
Organizations should prioritize immediate mitigation through patching Oracle Fusion Middleware components to address this vulnerability, as recommended by Oracle's security advisories. Network segmentation and firewall rules should be implemented to restrict access to T3 and IIOP ports, particularly for systems not requiring these legacy protocols. The principle of least privilege should be enforced across all Oracle WebCenter Enterprise Capture installations, ensuring that only authorized personnel have access to the system. Additionally, monitoring for unauthorized network connections to these specific protocol ports can help detect potential exploitation attempts. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and lateral movement within enterprise environments, as attackers could use the compromised system as a foothold to access other Oracle products or systems within the network infrastructure. Regular security assessments of Oracle Fusion Middleware installations should be conducted to identify similar vulnerabilities that may exist in other components of the Oracle suite.