What is the CVSS score of CVE-2026-60524?

CVE-2026-60524 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Webcenter Enterprise Capture are affected by CVE-2026-60524?

Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling complete system takeover via network-accessible WebLogic protocols.

How to fix or mitigate CVE-2026-60524?

Within 24 hours, identify all systems running Oracle WebCenter Enterprise Capture 12.2.1.4.0 or 14.1.2.0.0, assess network exposure of WebLogic T3/IIOP protocol interfaces, and restrict network access to these interfaces from untrusted sources while implementing monitoring for unauthorized connection attempts. In the first week, apply defense-in-depth controls including network segmentation to isolate Capture infrastructure, restrict administrative access to essential personnel, and enable comprehensive audit logging of T3/IIOP protocol activity. Over the following month, maintain vigilance on Oracle's Security Alerts page for patch release and establish an expedited change control process to deploy the patch immediately upon availability; if no patch emerges within 30 days, prepare alternative strategies including air-gapping or system replacement depending on business criticality.

Webcenter Enterprise Capture CVE-2026-60524

EUVD-2026-46886 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rgm5-whc9-77v3

Authentication Bypass Oracle Webcenter Enterprise Capture

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:11 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.