Oracle WebCenter Capture CVE-2026-60459

Exploitation requires network reachability to the Oracle WebCenter Enterprise Capture Client Bundle over HTTP and a low-privileged authenticated foothold - the CVSS vector's PR:L means the attacker must already possess some valid low-level privilege/account on the Capture instance, not full anonymity. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing, race, or non-default configuration is called out in Oracle's description. The scope change (S:C) means successful exploitation can affect resources beyond Capture itself. Limiting factors for defenders: the requirement for a low-privilege credential and network access to the Client Bundle endpoint means environments that isolate Capture behind internal networks/VPN and tightly control account issuance materially raise the bar; affected deployments are limited to versions 12.2.1.4.0 and 14.1.2.0.0.

The signals point to a genuine high priority rather than an inflated CVSS number. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes remote, low-complexity, no-user-interaction exploitation requiring only low privileges, and Oracle itself labels it 'easily exploitable' with a scope change to a 9.9 score. Countering that urgency, there is no EPSS value supplied, no proof-of-concept, and no CISA KEV listing, so there is currently no evidence of active exploitation - the risk is potential, not observed. No CWE is provided, which limits precise root-cause reasoning. The only sourcing is Oracle's own Critical Patch Update and the NVD/EUVD mirror, so affected-version and impact claims rest on vendor assertion. Net: treat as a critical-severity, high-urgency patch given the trivial exploitation profile, while recognizing exploitation is not yet confirmed in the wild.

An attacker who holds any low-privilege application account (or obtains one) sends a crafted HTTP request to the Oracle WebCenter Enterprise Capture Client Bundle over the network, requiring no user interaction and only low attack complexity. The request abuses the flaw to escalate control and, because of the scope change, take over the Capture instance and pivot into connected Fusion Middleware/content components. No public proof-of-concept is currently identified, so real-world weaponization would require original exploit development.