What is the CVSS score of CVE-2026-60461?

CVE-2026-60461 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Capture are affected by CVE-2026-60461?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical privilege escalation vulnerability allowing attackers with network access to achieve complete system…

How to fix or mitigate CVE-2026-60461?

Within 24 hours, identify and isolate all systems running Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 or 14.1.2.0.0 from untrusted networks; restrict T3/IIOP protocol access to authenticated internal systems only via firewall rules and network segmentation. Within 7 days, deploy intrusion detection signatures targeting T3/IIOP exploitation patterns, establish enhanced logging for WebLogic administrative access attempts, and rotate credentials for all service accounts. Within 30 days, contact Oracle support for patch availability and upgrade timelines; begin testing migration to patched versions when available, and evaluate alternative document capture platforms if Oracle cannot provide a remediation timeline.

Oracle WebCenter Capture CVE-2026-60461

EUVD-2026-46855 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-66vc-65fh-g4c2

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable over T3/IIOP with low complexity and no interaction; PR:L reflects the required low-privileged foothold, and scope change plus full takeover justify S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:05 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Enterprise Capture is a document imaging/capture application built on the Oracle Fusion Middleware / WebLogic Server stack. The affected surface is the Client Bundle component, and the attack is delivered over T3 and IIOP - proprietary RMI-style remote invocation protocols exposed by WebLogic Server. These protocols have historically been vectors for deserialization and remote object abuse in the Fusion Middleware ecosystem. No CWE was assigned in the source data, so the precise root-cause class (e.g., insecure deserialization, authorization bypass) cannot be confirmed from the provided intelligence; the scope-change flag (S:C) indicates the vulnerable component can affect resources beyond its own security authority, consistent with a shared WebLogic runtime where a compromise of Capture can pivot into co-hosted middleware services.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name an exact patched build number, so Patch available per vendor advisory - administrators should map their WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 deployments to the corresponding CPU patch set from that advisory. Because exploitation rides the WebLogic T3 and IIOP protocols, the strongest compensating control until patching completes is to restrict or disable those protocols: configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block external access to the WebLogic listen ports at the network firewall - note this can break legitimate RMI clients, cluster replication, and remote JMX/administration that rely on T3/IIOP, so validate in a staging environment first. Additionally enforce least privilege on Capture accounts to reduce the pool of low-privileged identities that satisfy the PR:L precondition.