Webcenter Enterprise Capture CVE-2026-60458

Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to complete platform compromise via low-privileged network access, with blast radius extending to dependent Oracle Fusion Middleware systems and enterprise data. The attack requires minimal technical sophistication and is exploitable to low-privileged users, creating high incident likelihood. With no vendor patch currently available, immediate interim containment is critical to prevent compromise.

Within 24 hours: Identify all systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0 and immediately block external access to T3 and IIOP protocols via firewall rules; restrict these protocols to authorized internal systems only. Within 7 days: Complete inventory of all dependent Oracle Fusion Middleware components connected to affected Capture instances; engage your Oracle account team to confirm patched version timelines and obtain upgrade roadmap; deploy detailed logging and alerting for authentication failures and privilege escalation on affected systems. Within 30 days: Execute tested migration to patched Capture version upon vendor release; if upgrade is delayed, formally approve and document compensating controls (network segmentation, access restrictions, monitoring) as interim security measures and provide leadership with remediation timeline.

Network isolation: Restrict T3 and IIOP protocol access to authorized internal systems only through firewall rules and network ACLs; block all external connections. Access hardening: Enforce multi-factor authentication and strict role-based access control to minimize attack surface from low-privileged accounts. Enhanced monitoring: Deploy real-time logging and alerting for authentication failures, privilege escalation attempts, and abnormal data access patterns on affected systems. Note: These controls are temporary mitigations; vendor patch deployment upon release is mandatory for permanent remediation.