What is the CVSS score of CVE-2026-60457?

CVE-2026-60457 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-60457?

Oracle WebCenter Enterprise Capture faces critical risk of complete system takeover through its WebLogic-based Client Bundle component, exposing affected deployments to full confidentiality,…

How to fix or mitigate CVE-2026-60457?

Within 24 hours, identify and document all Oracle WebCenter Capture deployments and their network connectivity; restrict T3 and IIOP protocol access to trusted internal networks only and disable these protocols if operationally feasible. Within 7 days, implement network segmentation to isolate Capture Client Bundle components from production systems and adjacent Fusion Middleware components; enforce multi-factor authentication for all administrative access to Capture; and establish continuous monitoring for suspicious T3/IIOP connection attempts. Within 30 days, coordinate with Oracle support for interim mitigation guidance and patching timeline; conduct full security assessments of connected Fusion Middleware components for lateral movement risk; and evaluate alternative document capture solutions with improved security postures.

Oracle WebCenter Capture CVE-2026-60457

EUVD-2026-46851 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jh8c-25mw-4284

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable T3/IIOP with low complexity and no user interaction, but a low-privilege foothold is required (PR:L); full takeover with scope change gives S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:02 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document-imaging and batch-capture application that runs atop Oracle WebLogic Server as part of Oracle Fusion Middleware. The affected 'Client Bundle' component is reached via T3 and IIOP - the proprietary RMI protocols WebLogic exposes for remote EJB/JMX invocation - which are historically dangerous because they can carry serialized Java objects and remote method calls. Oracle did not assign a CWE, but the exposure profile (network-reachable T3/IIOP endpoint, low privilege, full takeover with scope change) is consistent with the insecure-deserialization / remote-invocation weakness class that has repeatedly affected WebLogic surfaces. The scope change (S:C) indicates the vulnerable Capture component can affect resources managed by other security authorities, typical when a shared WebLogic runtime or trust boundary is crossed.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the only vendor remediation channel for this issue; Oracle does not publish standalone version numbers in the CPU text, so identify the exact patch bundle for your 12.2.1.4.0 or 14.1.2.0.0 installation from the CPU advisory matrix. Because the attack rides T3/IIOP, the strongest compensating control until patching is to restrict those protocols: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block external access to the WebLogic listen ports (default 7001/7002) at the network firewall - the trade-off is that legitimate remote administrative or EJB clients using T3/IIOP will also be blocked and must be explicitly allow-listed. Additionally place the Capture server behind a segmented management network and enforce least-privilege on any accounts that can authenticate to WebLogic, since the flaw requires only low privilege. These controls reduce reachability but do not eliminate the vulnerability, so treat them as interim measures only.