CVE-2026-60958

Received Received - Intake

Oracle WebCenter Enterprise Capture Remote Code Execution

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Enterprise Capture. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-60958

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	webcenter_enterprise_capture	to 12.2.1.4.0 (inc)
oracle	webcenter_enterprise_capture	to 14.1.2.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker to remotely compromise the system via HTTP, potentially leading to full system takeover. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Detection Guidance

This vulnerability can be detected by checking for the affected Oracle WebCenter Enterprise Capture versions (12.2.1.4.0 or 14.1.2.0.0) on your system. Inspect installed software versions and network services exposed via HTTP. No specific commands are provided in the context.

Impact Analysis

If you use affected versions of Oracle WebCenter Enterprise Capture, an attacker could gain complete control over the system without authentication. This could lead to data theft, unauthorized modifications, or system disruption. The high CVSS score suggests widespread potential impact.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations due to potential unauthorized access to sensitive data. A system takeover could result in data breaches, violating confidentiality requirements and leading to legal penalties.

Mitigation Strategies

Apply the latest security patches from Oracle to upgrade to a non-vulnerable version. If patches are unavailable, restrict network access to the HTTP interface, disable the service if possible, and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-60958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70