Oracle WebCenter Capture CVE-2026-60916

The affected surface is the Oracle WebCenter Enterprise Capture Client Bundle component reachable over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against affected default deployments of Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0, with no authentication and no user interaction required. The practical limiting factor is network reachability: the attacker must be able to send HTTP requests to the Capture Client Bundle endpoint, so deployments confined to isolated internal networks or fronted by access-controlled proxies are materially harder to reach than internet-exposed instances. Exploitation is also bounded to the two supported versions Oracle lists.

This is a genuine high-priority issue, not a high-score-but-low-risk artifact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivial, unauthenticated, no-interaction network exploitation, and the S:C scope change drives the score to 9.9 while signaling lateral impact to other products; integrity impact is High. The signals are consistent with each other rather than conflicting. Two caveats temper urgency: no EPSS score was provided in the input, and this is not listed in CISA KEV, so there is no confirmation of active exploitation - treat exploitation likelihood as inferred from the vector, not measured. Given the low exploitation barrier and Oracle-confirmed unauthenticated access, any organization exposing WebCenter Capture to reachable networks - even a mid-sized municipal IT team running a single Fusion Middleware instance - should treat patching as urgent, and internet-facing deployments especially so. The main open question is real-world exposure: many Capture deployments sit on internal networks, which reduces (but does not eliminate) practical risk.

An attacker who can reach the WebCenter Capture Client Bundle over HTTP sends crafted unauthenticated requests to the exposed endpoint, requiring no credentials or user interaction and low skill. They tamper with or delete captured documents and indexing data (High integrity impact), read a subset of accessible data, and degrade service, then leverage the scope change to affect integrated Fusion Middleware products. No public exploit is identified at time of analysis, so this reflects the CVSS-derived attack profile rather than an observed campaign.