Oracle WebCenter Capture CVE-2026-60947

Exploitation requires network access to the Oracle WebCenter Enterprise Capture server over the RMI protocol against the Client Bundle component; the server must expose its RMI listener to the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, and attack complexity is low, so default-configured, network-reachable instances of supported versions 12.2.1.4.0 and 14.1.2.0.0 are exploitable. The primary limiting factor is network exposure of the RMI service - deployments that firewall or segment RMI ports away from untrusted networks substantially reduce reachability, and only the two named Fusion Middleware versions are stated as affected.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction and yielding full system takeover - the maximum realistic threat profile short of a scope change. Oracle explicitly labels it 'easily exploitable.' Countervailing signals lower the immediacy somewhat: no EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation. No SSVC decision data was supplied. The Oracle-assigned tag 'Information Disclosure' understates the actual impact, which the description and vector describe as full takeover (C/I/A all High) - defenders should weight the vector and 'takeover' language over the tag. Net: treat as urgent for any exposed Capture deployment given trivial exploitability, while recognizing exploitation is currently theoretical pending POC or KEV signals.

An attacker with network reachability to the Capture server's RMI port sends a crafted RMI request to the Client Bundle endpoint without any credentials, exploiting the flaw to execute their own logic and seize control of the server. Because no authentication or user interaction is needed and complexity is low, a single unauthenticated request can escalate to full takeover of the Capture instance and its stored documents. No public exploit was identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's 'easily exploitable' characterization.