Oracle WebCenter Capture CVE-2026-60958

The only prerequisite stated is network access to the Oracle WebCenter Enterprise Capture service over HTTP; per the CVSS vector (PR:N/UI:N/AC:L) exploitation is unauthenticated, requires no user interaction, and is low-complexity against the affected supported versions 12.2.1.4.0 and 14.1.2.0.0. No special feature toggle or non-default configuration is called out in the description, so any reachable instance of these versions should be considered exploitable. The primary limiting factor is reachability: an instance segmented behind a VPN, firewall, or internal-only network is not exposed to remote attackers, which is the main real-world constraint on this otherwise unconditional vector.

The signals here align strongly toward high real-world risk rather than a paper-only high score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and Oracle's own language ('easily exploitable,' 'takeover') reinforces that. Countervailing signals: there is no EPSS score provided, no public POC identified, and the CVE is not in CISA KEV, so active exploitation is not confirmed and probability of imminent mass exploitation cannot be quantified from the supplied data. SSVC-style reasoning still favors urgency - technical impact is total, and an unauthenticated HTTP vector is inherently automatable if a POC emerges. Any organization running an internet- or intranet-exposed Capture instance should treat this as an urgent patch regardless of the missing EPSS/KEV data, because the barrier to weaponization is low once details circulate. The one tag present ('Information Disclosure') understates the impact - the CVSS vector and description indicate full compromise, not merely disclosure, so defenders should weight the vector over the tag.

An attacker who can reach the WebCenter Capture HTTP service - from the internet or a foothold on the internal network - sends a crafted request to the Client Bundle endpoint and, with no credentials and no user interaction, gains full control of the Capture instance and its document data. Given AV:N/AC:L/PR:N, this could be scripted and run at scale against exposed hosts. No public POC is identified at time of analysis, so this scenario is projected from the CVSS vector and Oracle's 'takeover' description rather than an observed exploit.