Oracle WebCenter Capture CVE-2026-60456

The attacker must have HTTP network reachability to the Oracle WebCenter Enterprise Capture Client Bundle component and must already possess low-level privileges (CVSS PR:L) - i.e., some valid authenticated account or session, not anonymous access. No user interaction is required (UI:N) and attack complexity is low (AC:L), so no special non-default configuration is documented as a prerequisite. The primary limiting factors are: the requirement for a valid low-privilege credential/session, that only versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and network exposure of the Capture HTTP interface - if the interface is confined to an internal management segment, remote exploitation is correspondingly constrained.

Signals are mixed between severity and demonstrated exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) is severe: network attack vector, low complexity, only low privileges required, no user interaction, scope change, and full CIA impact - meaning any authenticated low-privilege user can escalate to full product takeover with cascading effect. However, there is no EPSS score provided, no CISA KEV listing, and no POC referenced, so real-world exploitation is unproven and probability cannot be quantified from the data. The PR:L requirement is the main limiting factor: an attacker needs some valid low-level access rather than pure anonymous reach, which reduces mass-scanning exposure relative to a PR:N flaw. Note a signal tension worth flagging: Oracle's tags label this 'Information Disclosure,' yet the CVSS vector and Oracle's own text describe full Confidentiality, Integrity, and Availability impact and 'takeover' - treat the tag as incomplete and rely on the CVSS/takeover description. This is a genuine high priority for organizations running the affected versions, but priority should be tempered by whether the product is internet-exposed and by the absence of any active-exploitation evidence.

An attacker who holds or phishes a low-privilege Oracle WebCenter Enterprise Capture account sends crafted HTTP requests to the Client Bundle component and, exploiting the flaw, escalates to full control of the Capture instance. Because the vulnerability carries a scope change, the attacker then leverages Capture's trust relationships to reach integrated content-management or identity resources, exfiltrating or tampering with ingested documents. No public POC is identified at time of analysis, but Oracle characterizes the vulnerability as 'easily exploitable' with low attack complexity.