What is the CVSS score of CVE-2026-60447?

CVE-2026-60447 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WebCenter Enterprise Capture are affected by CVE-2026-60447?

Oracle WebCenter Enterprise Capture (CVE-2026-60447) is vulnerable to complete system compromise by any low-privileged network user, with impact extending to connected infrastructure through a…

How to fix or mitigate CVE-2026-60447?

Within 24 hours, compile inventory of all WebCenter Enterprise Capture (CVE-2026-60447) deployments and assess network exposure; implement continuous monitoring for HTTP requests with suspicious patterns to the Capture component and review authentication logs for unauthorized low-privileged account activity. Within 7 days, isolate affected systems behind additional network controls including WAF rules blocking known attack patterns, restrict network access to Capture to trusted internal networks only, and disable or restrict low-privilege accounts with network access to the component. Within 30 days, evaluate migration timelines from WebCenter Enterprise Capture to vendor-supported alternatives, coordinate with Oracle for targeted guidance on compensating controls, and conduct incident response tabletop exercises to simulate breach scenarios given the scope of impact to connected systems.

WebCenter Enterprise Capture CVE-2026-60447

EUVD-2026-46843 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-px68-75pp-v2c6

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reachable and easily exploitable with a low-privileged account (PR:L, AC:L), no user interaction, full C/I/A takeover, and Oracle-confirmed scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:53 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a Java/Oracle Fusion Middleware application used for high-volume document capture, imaging, and ingestion into enterprise content management (WebCenter Content / ECM) workflows. The vulnerable component is the 'Client Bundle,' the client-facing tier exposed over HTTP. Oracle's CPU advisory does not disclose the root-cause CWE (CWE listed as N/A) or code-level detail, which is standard for Oracle CPU entries; the CVSS scope change (S:C) indicates the vulnerable component can grant control over resources managed by a different security authority - typical of a client/agent component that can pivot into the backend content store or the WebLogic-hosted application it integrates with. Because Capture is deployed as part of a broader Fusion Middleware/WebLogic stack, compromise of this tier plausibly reaches adjacent middleware services.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch/bundle for affected versions 12.2.1.4.0 and 14.1.2.0.0; the advisory did not enumerate a discrete fixed version string in this input, so treat the CPU July 2026 patch set as the released fix and follow Oracle's per-version instructions (Patch available per vendor advisory). Because Oracle CPU patches are cumulative and require downtime plus regression testing, prioritize scheduling around a maintenance window. As compensating controls until patched: restrict network reachability of the Capture Client Bundle HTTP endpoints to trusted management networks or behind a VPN/reverse proxy with strict allowlisting (trade-off: may break legitimate remote capture clients); tighten account privileges since exploitation needs a low-privileged authenticated foothold, so audit and reduce Capture user accounts and rotate credentials (trade-off: administrative overhead); and increase monitoring/WAF inspection on Capture HTTP traffic for anomalous requests (trade-off: signatures are unavailable without exploit details, so this is detective, not preventive).