CVE-2026-60458 Oracle Corporation CVE debrief

Who should care

Administrators of Oracle WebCenter Enterprise Capture, security teams, and IT professionals responsible for applying security patches and monitoring system vulnerabilities should be aware of this vulnerability and take necessary actions to mitigate the risk. They should review and apply Oracle's security patches, restrict network access, and monitor for suspicious activity.

Technical summary

The CVE-2026-60458 vulnerability is in the Client Bundle component of Oracle WebCenter Enterprise Capture, with a CVSS score of 9.9 and a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It can be exploited by low-privileged attackers with network access via T3 or IIOP, potentially impacting additional products. Successful attacks can result in takeover of Oracle WebCenter Enterprise Capture. The vulnerability affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The evidence is limited to public sources and may not reflect the full scope of the vulnerability.

Defensive priority

Oracle WebCenter Enterprise Capture vulnerability with a CVSS score of 9.9, allowing low-privileged attackers to compromise the product via T3 or IIOP.

Recommended defensive actions

• Review and apply Oracle's security patches for WebCenter Enterprise Capture
• Restrict network access to the affected product
• Monitor for suspicious activity on the affected system
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-60458 vulnerability affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0, with a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vulnerability has a high impact on confidentiality, integrity, and availability. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The evidence is limited to public sources and may not reflect the full scope of the vulnerability.

Official resources