Oracle WebCenter EC Capture v12.2.1.4.0/14.1.2.0.0 Client Bundle RCE (CVE-2026-60458)
CVE-2026-60458 Published on July 21, 2026
Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Vulnerability Analysis
CVE-2026-60458 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-60458
stack.watch emails you whenever new vulnerabilities are published in Oracle Webcenter Enterprise Capture or Oracle. Just hit a watch button to start following.
Affected Versions
Oracle Corporation Oracle WebCenter Enterprise Capture:- Version 12.2.1.4.0 is affected.
- Version 14.1.2.0.0 is affected.