What is the CVSS score of CVE-2026-60446?

CVE-2026-60446 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-60446?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing unauthenticated remote attackers to completely compromise affected systems via T3/IIOP…

How to fix or mitigate CVE-2026-60446?

Within 24 hours, identify and catalog all Oracle WebCenter Enterprise Capture instances running versions 12.2.1.4.0 or 14.1.2.0.0, including network location and criticality rating. Within 7 days, implement firewall rules and network segmentation restricting T3/IIOP protocol access (typically ports 7001/7002) to authorized internal systems only; disable these protocols entirely if business operations do not require them. Within 30 days, establish a patch monitoring process for Oracle advisories, contact Oracle Support for remediation guidance and patch timelines, and develop a detailed upgrade plan to migrate affected instances to patched versions as soon as they become available.

Oracle WebCenter Capture CVE-2026-60446

EUVD-2026-46842 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-34mv-vh59-6543

Authentication Bypass Oracle Webcenter Enterprise Capture

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated T3/IIOP network vector with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full product takeover, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:53 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture module of Oracle Fusion Middleware that runs on the Oracle WebLogic Server stack; the affected 'Client Bundle' component and the named T3 and IIOP protocols are WebLogic's proprietary RMI transport protocols used for remote EJB/JMX and object communication. Vulnerabilities reachable over T3/IIOP in the Oracle/WebLogic ecosystem are historically rooted in unsafe Java object deserialization (CWE-502) exposed on the listen port, though the official CWE here is listed as N/A and Oracle does not disclose root-cause internals in its Critical Patch Update advisories. Because these protocols are handled before application-level authentication in many configurations, a crafted serialized object stream delivered to the WebLogic listen port (default 7001, or the configured T3/IIOP port) is the classic path to remote code execution and full server takeover.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch-available-per-vendor-advisory, but Oracle CPUs ship cumulative bundle patches rather than a single tagged release, so an exact fixed build number is not independently confirmed in the input and should be taken from the CPU patch matrix for your platform. Until patching, reduce exposure of the T3/IIOP attack surface: restrict access to the WebLogic listen port (commonly 7001) so only trusted management hosts can reach T3/IIOP, using network ACLs, firewalls, or a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow-list T3/T3S/IIOP by source - noting this can break legitimate remote clients or clustering if over-restricted. Where remote T3/IIOP is not required, disable or block the IIOP protocol and terminate external T3 at a proxy, and keep the capture server off the public internet entirely. These are compensating controls only; the Oracle CPU patch is the definitive fix.