CVE-2026-60445: Oracle WebCenter Enterprise Capture RCE

CVE-2026-60445 Overview

CVE-2026-60445 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise Oracle WebCenter Enterprise Capture. Successful exploitation results in full product takeover with impacts to confidentiality, integrity, and availability. Because the vulnerability produces a scope change, attacks may significantly impact additional products beyond the vulnerable component itself.

Critical Impact
Remote, low-privileged attackers can take over Oracle WebCenter Enterprise Capture over T3/IIOP and pivot to additional Fusion Middleware components due to scope change.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-07-21 - CVE-2026-60445 published to the National Vulnerability Database
2026-07-21 - Oracle Critical Patch Update July 2026 published
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60445

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, a document capture and imaging solution within Oracle Fusion Middleware. Exploitation requires only low privileges and no user interaction. The attacker reaches the target over the network using Oracle's proprietary T3 protocol or the Internet Inter-ORB Protocol (IIOP), both of which are commonly enabled on WebLogic-based Fusion Middleware deployments.

The issue produces a scope change, meaning a successful attack against WebCenter Enterprise Capture can extend impact to additional resources or products managed under a different security authority. The result is complete takeover of the target, with high impact to confidentiality, integrity, and availability.

Root Cause

Oracle has not published root cause details in the public advisory. Historical vulnerabilities affecting the T3 and IIOP transports in Oracle Fusion Middleware have typically involved unsafe Java deserialization of attacker-supplied objects reaching internal endpoints. Consult the Oracle Critical Patch Update July 2026 advisory for authoritative technical details.

Attack Vector

The attack vector is network-based over T3 or IIOP. The attacker authenticates with low privileges, sends a crafted request to the exposed Fusion Middleware listener, and gains control of the WebCenter Enterprise Capture instance. No user interaction is required, and the scope change enables lateral impact against adjacent Fusion Middleware components sharing the same runtime context. No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-60445

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001, 7002) or IIOP endpoints from untrusted networks.
Anomalous serialized Java object payloads in application server access logs and traffic captures.
Newly spawned child processes from WebLogic managed server JVMs (for example, cmd.exe, /bin/sh, powershell.exe).
Unexpected outbound network traffic from the WebCenter Enterprise Capture host to attacker-controlled infrastructure.

Detection Strategies

Inspect WebLogic server logs for authentication events by low-privilege accounts followed by administrative or deployment actions.
Monitor for JVM child process creation on Fusion Middleware hosts, which typically indicates command execution through a deserialization or injection chain.
Deploy network signatures for known Java serialization gadget markers (rO0AB, aced0005) traversing T3/IIOP flows.

Monitoring Recommendations

Enable WebLogic auditing at the Medium or higher level and forward logs to a centralized SIEM for correlation.
Baseline expected T3 and IIOP peers and alert on connections from any source outside that baseline.
Track process ancestry on Fusion Middleware servers to identify unusual command execution originating from java processes.

How to Mitigate CVE-2026-60445

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 deployments without delay.
Restrict network exposure of T3 and IIOP listener ports to trusted management networks only.
Rotate credentials for any low-privileged accounts that could reach the WebCenter Enterprise Capture listeners.
Review Fusion Middleware audit logs for suspicious activity since the affected versions were deployed.

Patch Information

Oracle addressed CVE-2026-60445 in the Oracle Critical Patch Update July 2026. Administrators must apply the patches listed for Oracle WebCenter Enterprise Capture on both 12.2.1.4.0 and 14.1.2.0.0. Verify successful patch application through Oracle's OPatch inventory tools before returning systems to production.

Workarounds

Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources.
Place Fusion Middleware behind a network segmentation boundary that permits only authenticated administrative access.
Disable IIOP in the WebLogic administration console if the protocol is not required by any application.

bash

# Example WebLogic Connection Filter rules to restrict T3/IIOP
# Set in Admin Console: Domain > Security > Filter
10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops