Oracle WebCenter Capture CVE-2026-60971

Exploitation requires network reachability to the target's WebLogic T3 and/or IIOP listener (typically the administration or managed-server port, commonly 7001/7002) serving the Oracle WebCenter Enterprise Capture Client Bundle component. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special product configuration are required against affected default deployments of versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is exposure of the T3/IIOP ports: environments that firewall these protocols to trusted management hosts or disable external access substantially reduce reachability, and only the two named supported versions are stated as affected.

All available signals point to a genuine high priority rather than an inflated high-CVSS issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes trivial remote unauthenticated exploitation with full impact, and Oracle's own description explicitly calls it 'easily exploitable' resulting in 'takeover'. Working against widespread urgency, no EPSS score, KEV listing, SSVC decision, or public POC was supplied, so there is currently no evidence of active or automated exploitation - the risk is assessed on inherent exploitability, not observed campaigns. The T3/IIOP attack pattern is historically a favorite for mass exploitation once tooling appears, so the low observed-exploitation signal should be treated as 'not yet' rather than 'low risk'. The single ambiguity worth noting: the 'Tags: Information Disclosure' hint understates the actual CIA:H/takeover impact stated by Oracle - trust the CVSS vector and description over the tag.

An attacker who can reach the WebLogic T3 or IIOP listener sends a crafted request to the WebCenter Capture Client Bundle endpoint that abuses insecure remote object handling to execute their payload without any credentials. Because the attack is network-based, low-complexity, and requires no authentication or user interaction, a single request can lead to full server takeover. No public exploit code was identified at time of analysis, but the T3/IIOP attack surface is well understood and historically weaponized quickly.