CVE-2026-60460: Oracle WebCenter Enterprise Capture RCE

CVE-2026-60460 Overview

CVE-2026-60460 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. The flaw allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the affected system. Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability was published to the NVD on 2026-07-21 and addressed in the Oracle Critical Patch Update advisory for July 2026.

Critical Impact
An unauthenticated remote attacker can take over Oracle WebCenter Enterprise Capture instances exposed via T3 or IIOP, resulting in full loss of confidentiality, integrity, and availability.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware deployments exposing T3 or IIOP interfaces

Discovery Timeline

2026-07-21 - Oracle publishes fix in the Oracle Security Alert - July 2026
2026-07-21 - CVE-2026-60460 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60460

Vulnerability Analysis

CVE-2026-60460 resides in the Client Bundle component of Oracle WebCenter Enterprise Capture. The vulnerability is reachable through the Transactional (T3) protocol and Internet Inter-ORB Protocol (IIOP), both used by WebLogic-based Fusion Middleware products for remote object communication. An attacker requires no credentials and no user interaction to exploit the flaw over the network. Successful exploitation yields full takeover of the WebCenter Enterprise Capture instance, meaning the attacker can read sensitive data, modify records, and disrupt service. Oracle rates the issue as "easily exploitable," indicating a low barrier to weaponization once the network path is available. The EPSS probability is 0.358% with a percentile of 28.265, reflecting current predicted exploitation likelihood.

Root Cause

Oracle has not disclosed the underlying defect class in the public advisory. Historically, unauthenticated network takeovers reachable through T3 and IIOP in Fusion Middleware have stemmed from insecure deserialization of Java objects in RMI-style protocols. Refer to the Oracle Security Alert - July 2026 for authoritative technical detail.

Attack Vector

The attack vector is remote and network-based. An attacker sends crafted requests to the exposed T3 or IIOP listener of the WebCenter Enterprise Capture server. No authentication, user interaction, or elevated privilege is required. Environments that expose WebLogic listen ports (default 7001, 7002) directly to untrusted networks are at highest risk.

No verified public proof-of-concept is available at the time of publication. See the vendor advisory for technical details.

Detection Methods for CVE-2026-60460

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 or IIOP listener ports (7001, 7002, 7003) from untrusted networks.
New or modified Java classes, JSP files, or scheduled jobs within the WebCenter Enterprise Capture domain directory.
Anomalous child processes spawned by the WebLogic managed server JVM, such as shells or curl/wget invocations.
Outbound connections from the Fusion Middleware host to unfamiliar IP addresses following T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access and audit logs for T3 or IIOP requests carrying serialized Java payloads or unexpected classloading activity.
Correlate network flow data with process telemetry to surface JVM processes initiating outbound connections after inbound T3/IIOP traffic.
Deploy network signatures matching known T3 deserialization gadget chains at perimeter inspection points.

Monitoring Recommendations

Continuously monitor the identity and integrity of files under $DOMAIN_HOME/servers/ and Capture-specific deployment directories.
Alert on any authentication or configuration changes to the WebCenter Enterprise Capture administrative interface.
Track exposure of T3 and IIOP ports using external attack-surface scans and internal port inventory.

How to Mitigate CVE-2026-60460

Immediate Actions Required

Apply the Oracle Critical Patch Update for July 2026 to all affected Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network access to T3 and IIOP listener ports so they are reachable only from trusted management networks.
Audit WebLogic domains for signs of prior exploitation before and after patching.
Rotate credentials and secrets stored within the Fusion Middleware domain if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60460 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert - July 2026 for both 12.2.1.4.0 and 14.1.2.0.0 release trains.

Workarounds

Disable the T3 and IIOP protocols on WebLogic managed servers where they are not required for application functionality.
Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to permit T3 and IIOP only from explicitly listed management hosts.
Place the WebCenter Enterprise Capture server behind a reverse proxy or firewall that terminates only required HTTPS traffic.
Segment Fusion Middleware hosts into a dedicated network zone with strict ingress and egress controls.

bash

# WebLogic connection filter rules example (place in server startup or via console)
# Deny T3 and IIOP from all sources except an explicit allowlist
-Dweblogic.security.net.ConnectionFilter=weblogic.security.net.ConnectionFilterImpl
# Rules (configured in Admin Console > Domain > Security > Filter):
#   10.10.0.0/24  * *  allow t3 t3s iiop iiops
#   0.0.0.0/0     * *  deny  t3 t3s iiop iiops