CVE-2026-60446: Oracle WebCenter Enterprise Capture RCE

CVE-2026-60446 Overview

CVE-2026-60446 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product, part of Oracle Fusion Middleware. The flaw resides in the Client Bundle component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker with network access via T3 or IIOP protocols can exploit this vulnerability. Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, compromising confidentiality, integrity, and availability. Oracle disclosed the vulnerability in its July 2026 Critical Patch Update.

Critical Impact
An unauthenticated network attacker can fully compromise Oracle WebCenter Enterprise Capture instances exposing T3 or IIOP protocols, leading to complete system takeover.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-07-21 - CVE-2026-60446 published to NVD as part of Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60446

Vulnerability Analysis

CVE-2026-60446 affects the Client Bundle component of Oracle WebCenter Enterprise Capture, a document imaging and capture solution within Oracle Fusion Middleware. Attackers reach the flaw through Oracle's proprietary T3 remoting protocol and the CORBA-based Internet Inter-ORB Protocol (IIOP). Both protocols are commonly enabled on WebLogic Server deployments hosting Fusion Middleware components. Historically, T3 and IIOP have exposed Fusion Middleware to deserialization-class flaws that yield unauthenticated remote code execution. The Oracle advisory classifies this issue as easily exploitable and confirms full takeover as the outcome. The current EPSS probability is 0.358%.

Root Cause

Oracle has not published root cause specifics beyond the affected component and protocol surface. The Client Bundle component processes serialized objects delivered over T3 and IIOP endpoints. Weaknesses in this processing path allow an unauthenticated actor to influence server-side execution without valid credentials or user interaction.

Attack Vector

The attack vector is network-based. An attacker sends crafted T3 or IIOP traffic to a reachable WebLogic listener that hosts the WebCenter Enterprise Capture Client Bundle. No authentication, privileges, or user interaction are required. Because T3 and IIOP are typically not exposed to the internet by design but are often reachable within enterprise networks, both external attackers on exposed instances and internal adversaries can weaponize the flaw. Refer to the Oracle Security Alert - July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60446

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001, 7002) or IIOP ports from untrusted sources.
New or unusual child processes spawned by the WebLogic Server Java process hosting WebCenter Enterprise Capture.
Anomalous outbound network connections from Fusion Middleware hosts, including reverse shells or LDAP/DNS callbacks.
Modifications to WebLogic domain files, deployment directories, or scheduled tasks on the middleware host.

Detection Strategies

Monitor WebLogic access and audit logs for malformed T3/IIOP handshake traffic and deserialization exceptions.
Deploy network detection rules that flag T3 protocol traffic outside authorized administrative sources.
Correlate Java process behavior on Fusion Middleware hosts with file system and network telemetry to surface post-exploitation activity.

Monitoring Recommendations

Baseline expected T3 and IIOP client sources and alert on deviations.
Forward WebLogic server logs, OS audit logs, and EDR telemetry to a centralized SIEM for correlation.
Track process ancestry from java processes hosting the WebCenter Enterprise Capture domain to detect command execution.

How to Mitigate CVE-2026-60446

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to affected Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 deployments without delay.
Restrict network access to T3 and IIOP listener ports to trusted administrative hosts only.
Inventory all Fusion Middleware instances and confirm whether the WebCenter Enterprise Capture Client Bundle is deployed.

Patch Information

Oracle released fixes as part of the Critical Patch Update published on July 2026. See the Oracle Security Alert - July 2026 for patch identifiers, download locations, and version-specific guidance. Apply patches following Oracle's documented Fusion Middleware upgrade procedures and validate service functionality post-patch.

Workarounds

Use WebLogic Server connection filters (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP traffic from untrusted networks until patching is complete.
Disable IIOP in the WebLogic administration console if the protocol is not required for business operations.
Place Fusion Middleware hosts behind network segmentation that restricts management protocols to jump hosts and administrative VLANs.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Configure in the WebLogic Admin Console: Domain -> Security -> Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.0.0.0/8   * *   allow  t3 t3s iiop iiops
*            * *   deny   t3 t3s iiop iiops