What is the CVSS score of CVE-2026-60460?

CVE-2026-60460 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-60460?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to unauthenticated remote code execution, allowing attackers to achieve complete system takeover without…

How to fix or mitigate CVE-2026-60460?

Within 24 hours: inventory all Oracle Fusion Middleware deployments to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0; immediately restrict firewall access to T3 (port 7001-7002) and IIOP (port 7003) protocols to only trusted internal networks or hosts if business operations permit, and consider network isolation of affected systems from production workloads. Within 7 days: contact Oracle support to determine patched version availability and upgrade timelines; assess application dependencies and compatibility for migration to a newer version; deploy intrusion detection and prevention rules to monitor for exploitation attempts targeting these specific protocols and versions. Within 30 days: execute a full upgrade to a patched version of Oracle Fusion Middleware or, if not feasible, establish permanent network segmentation as a long-term compensating control with a binding organizational deadline for remediation within 90 days.

Oracle WebCenter Capture CVE-2026-60460

EUVD-2026-46854 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-v83g-772p-77m8

Authentication Bypass Oracle Webcenter Enterprise Capture

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network exploitation over T3/IIOP with low complexity and no user interaction, yielding full application takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:04 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging and capture application built on the Oracle WebLogic Server / Fusion Middleware stack. The affected 'Client Bundle' component is reached via T3 and IIOP - WebLogic's proprietary RMI transport protocols used for remote EJB and JNDI operations. These protocols are a long-standing WebLogic attack surface because they deserialize Java objects sent by remote clients; historically, T3/IIOP exposure has enabled Java deserialization gadget chains leading to remote code execution. Oracle did not assign a CWE (listed N/A) and does not publish root-cause detail, but the T3/IIOP vector combined with a full-takeover outcome is consistent with an unauthenticated remote code execution or unsafe deserialization class of bug rather than mere information disclosure.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; Oracle CPUs do not publish a separate fixed build string in the CVE record, so validate the exact patch/PSU number for your 12.2.1.4.0 or 14.1.2.0.0 deployment against the CPU matrix). Because the vector is T3/IIOP, the highest-value compensating control is to restrict those protocols: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3S/IIOP from untrusted networks, and place the managed server behind a firewall that blocks the WebLogic listen port (commonly 7001/7002) from the internet and any untrusted segment - the trade-off is that legitimate remote RMI/EJB clients and some management tooling that rely on T3/IIOP will break and must be explicitly allow-listed. Disabling IIOP in the server configuration where it is unused further reduces the surface with minimal impact. These controls reduce exposure but are not a substitute for the CPU patch.