CVE-2026-60970

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle WebCenter Enterprise Capture (component: Client Bundle) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Risk Assessment

The risk for the organization is critical as an attacker can fully take over the WebCenter Enterprise Capture system, potentially leading to data confidentiality breaches, modification, or service disruption.

Recommendation

Apply immediately the patches provided by Oracle and restrict network access to T3 and IIOP services.

Original NVD description (English source)

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).