What is the CVSS score of CVE-2026-60445?

CVE-2026-60445 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-60445?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete system takeover by authenticated attackers with low privilege network access via WebLogic protocols,…

How to fix or mitigate CVE-2026-60445?

Within 24 hours, inventory all Oracle WebCenter Enterprise Capture deployments running versions 12.2.1.4.0 or 14.1.2.0.0 and map network access points for WebLogic T3 and IIOP protocols; no public exploit identified at time of analysis, but severity warrants urgent attention. Within 7 days, obtain Oracle's July 2026 Critical Patch Update, test in a non-production environment, and initiate staged deployment to production systems prioritized by business impact. Within 30 days, complete patching of all instances and verify successful remediation.

Oracle WebCenter Capture CVE-2026-60445

EUVD-2026-46841 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c9px-8x8v-4qrw

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network T3/IIOP reach gives AV:N/AC:L; a required low-priv account gives PR:L; Oracle-stated takeover plus impact on other products gives S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:53 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-imaging and content-capture application built on the Oracle WebLogic Server / Fusion Middleware stack. The flaw resides in the 'Client Bundle' component and is reachable over T3 and IIOP - the proprietary Java RMI protocols WebLogic exposes for remote EJB and JMX invocation. These protocols historically carry serialized Java objects, and Oracle CPU issues in this class routinely stem from insecure deserialization or unauthenticated remote invocation of privileged operations (CWE-502 / CWE-284 family), though Oracle publishes CWE as N/A here so the exact root cause class is not confirmed. The scope-change flag indicates the vulnerable Capture component can be leveraged to affect resources managed by other components sharing the WebLogic domain.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 12.2.1.4.0 and 14.1.2.0.0 deployments; Oracle does not publish a discrete fixed build number in this input, so obtain the specific CPU patch for your version from My Oracle Support. Because the attack rides on T3 and IIOP, the highest-value compensating control until patching is to restrict those protocols: configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from trusted management hosts, or disable the IIOP protocol on channels where it is not required, and firewall the WebLogic listen ports so they are not reachable from general user or internet-facing networks. The trade-off is that connection filtering and disabling IIOP can break legitimate remote EJB/JMX clients and inter-domain calls, so validate integrations in staging first. These are mitigations, not substitutes for the CPU patch.