CVE-2026-60458: Oracle WebCenter Enterprise Capture RCE

CVE-2026-60458 Overview

CVE-2026-60458 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, affecting the Client Bundle component. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are impacted. The flaw allows a low-privileged attacker with network access via the T3 or IIOP protocols to compromise Oracle WebCenter Enterprise Capture. Successful exploitation results in complete takeover of the affected instance. Because the vulnerability crosses a security scope boundary, exploitation may significantly affect additional products beyond WebCenter Enterprise Capture itself.

Critical Impact
Remote attackers with only low-level credentials can fully compromise Oracle WebCenter Enterprise Capture over T3 or IIOP, with impacts extending to adjacent Fusion Middleware components.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-07-21 - Oracle publishes fix as part of the Critical Patch Update - July 2026
2026-07-21 - CVE-2026-60458 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60458

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, a document imaging and capture solution within Oracle Fusion Middleware. Attackers reach the vulnerable code path through the T3 (Oracle WebLogic's Remote Method Invocation protocol) and IIOP (Internet Inter-ORB Protocol) interfaces. Both protocols historically expose Java object handling paths that can lead to deserialization or authorization weaknesses in Fusion Middleware components.

Exploitation requires only low-privileged network access, no user interaction, and low attack complexity. A successful attack yields full loss of confidentiality, integrity, and availability. The scope change indicates that the vulnerable component can influence resources managed by other security authorities, allowing attackers to pivot from WebCenter Enterprise Capture into adjacent Fusion Middleware services.

The EPSS score is 0.447% with a percentile of 36.442 as of 2026-07-23, indicating no active exploitation prediction at publication. Oracle has not released technical detail beyond the advisory.

Root Cause

Oracle's advisory does not disclose the underlying weakness class. T3 and IIOP attack surfaces in Fusion Middleware have historically been associated with unsafe Java deserialization and insufficient authorization checks on remote method invocations. See the Oracle Critical Patch Update July 2026 for authoritative details.

Attack Vector

The attacker requires network reachability to the T3 or IIOP listener ports of the WebLogic Server hosting WebCenter Enterprise Capture. With a low-privileged account, the attacker sends crafted remote invocations that trigger the vulnerable Client Bundle code path. The scope change (S:C) means the resulting compromise can extend beyond the WebCenter Enterprise Capture security authority into other Fusion Middleware services running on the same platform.

No public proof-of-concept code is available at the time of publication. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor guidance.

Detection Methods for CVE-2026-60458

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listen ports (default 7001) or IIOP ports from untrusted networks or non-administrative subnets.
New or unusual Java processes, scheduled tasks, or child processes spawned by the WebLogic managed server hosting WebCenter Enterprise Capture.
Anomalous outbound connections from the WebCenter Enterprise Capture host, indicating post-exploitation command-and-control or lateral movement.
Unexpected modifications to WebCenter Enterprise Capture configuration files, deployment descriptors, or user account stores.

Detection Strategies

Inspect WebLogic access and audit logs for T3 and IIOP requests originating from low-privileged accounts that invoke administrative or serialization-heavy endpoints.
Monitor Fusion Middleware audit trails for privilege changes, session anomalies, or scope crossings between WebCenter Enterprise Capture and adjacent products.
Correlate authentication events with subsequent object deserialization exceptions or class-not-found stack traces in WebLogic server logs.

Monitoring Recommendations

Alert on any T3 or IIOP traffic reaching the WebCenter Enterprise Capture host from outside the trusted administrative segment.
Track Oracle Fusion Middleware patch levels through configuration management and flag hosts running 12.2.1.4.0 or 14.1.2.0.0 without the July 2026 CPU applied.
Baseline outbound network activity from the middleware tier and alert on deviations that could indicate post-compromise behavior.

How to Mitigate CVE-2026-60458

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 deployments without delay.
Restrict T3 and IIOP protocol access at the network perimeter and internal segmentation layer, permitting only trusted administrative hosts.
Audit and rotate credentials for all accounts capable of authenticating to WebLogic administrative interfaces on affected servers.
Review WebCenter Enterprise Capture and adjacent Fusion Middleware components for signs of compromise consistent with scope-changing attacks.

Patch Information

Oracle addressed CVE-2026-60458 in the Oracle Critical Patch Update - July 2026. Administrators must download and apply the patches corresponding to their WebCenter Enterprise Capture version. Oracle recommends staying on actively supported release trains and applying CPUs at each quarterly cycle.

Workarounds

Disable the T3 and IIOP protocols on WebLogic managed servers where they are not required, or restrict them through WebLogic connection filters.
Deploy a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to explicitly allow-list administrative source IP addresses for T3 and IIOP.
Place the WebCenter Enterprise Capture tier behind a reverse proxy or firewall that terminates only required application-layer protocols.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Configure in the WebLogic Admin Console: Security > Filter
10.0.0.0/8 * allow t3 t3s iiop iiops
0.0.0.0/0  * deny  t3 t3s iiop iiops