CVE-2026-60921: Oracle WebCenter Auth Bypass Vulnerability

CVE-2026-60921 Overview

CVE-2026-60921 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. The flaw is easily exploitable and allows an unauthenticated remote attacker with network access via T3 or Internet Inter-ORB Protocol (IIOP) to fully compromise the affected system. Successful exploitation results in complete takeover of Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability. The vulnerability maps to [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated network attackers can take over Oracle WebCenter Enterprise Capture via exposed T3/IIOP protocol listeners without user interaction.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-08-18 - CVE CVE-2026-60921 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in the NVD database
2026-08-18 - Oracle publishes security alert referencing this issue in the Oracle Security Alert Advisory

Technical Details for CVE-2026-60921

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, part of Oracle Fusion Middleware. Attackers reach the flaw over the network by communicating with the WebLogic Server T3 or IIOP listeners that WebCenter Enterprise Capture exposes. No authentication and no user interaction are required to exploit it.

The attack surface aligns with a long-running class of Oracle Fusion Middleware issues in which the T3 and IIOP protocols accept remote requests that bypass access control on internal services. Because the issue is scored across confidentiality, integrity, and availability, a successful attacker can read sensitive data, modify server state, and disrupt the service. Oracle categorizes the outcome as full product takeover.

The EPSS score at publication is 0.486% (percentile 39.99), reflecting current model estimates of near-term exploitation likelihood rather than any observed campaign.

Root Cause

Oracle has classified the underlying weakness as improper access control [CWE-284]. The Client Bundle component fails to correctly enforce authorization for requests arriving over the T3 and IIOP remoting protocols, allowing unauthenticated callers to invoke privileged functionality. Oracle has not published deeper technical detail beyond the security alert.

Attack Vector

Exploitation is remote and network-based. An attacker sends crafted T3 or IIOP requests to a WebLogic Server hosting Oracle WebCenter Enterprise Capture. Because the protocols are typically bound to internal management ports rather than HTTPS, exposure of these ports to untrusted networks materially increases risk. Refer to the Oracle Security Alert for vendor guidance; no verified public proof-of-concept is available at this time.

No verified exploit code is publicly available. See the Oracle Security Alert
referenced above for vendor-provided technical detail and fixed versions.

Detection Methods for CVE-2026-60921

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001/7002) or IIOP ports from external or non-administrative networks.
New or modified deployed applications, MBeans, or scheduled jobs inside the WebCenter Enterprise Capture domain.
WebLogic domain log entries showing anonymous or unauthenticated invocations of internal services from the Client Bundle.

Detection Strategies

Inspect WebLogic access and audit logs for T3/IIOP requests originating from IP ranges that should not reach the middleware tier.
Alert on process creation by the WebLogic managed server user account, especially java spawning shells, cmd.exe, or powershell.exe.
Correlate outbound network connections from the WebLogic host with process lineage to identify post-exploitation callbacks.

Monitoring Recommendations

Forward WebLogic Server, operating system, and network telemetry into a centralized analytics platform for cross-source correlation.
Baseline normal T3/IIOP traffic between application tiers so that anomalous external clients are visible.
Track file writes and configuration changes under the WebCenter Enterprise Capture domain directory.

How to Mitigate CVE-2026-60921

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert to all instances of Oracle WebCenter Enterprise Capture running 12.2.1.4.0 or 14.1.2.0.0.
Restrict network exposure of WebLogic T3 and IIOP ports to trusted administrative networks only.
Audit WebLogic and WebCenter Enterprise Capture logs for signs of prior exploitation before, during, and after patching.

Patch Information

Oracle addressed this vulnerability in a security alert published for August 2026. Administrators should follow the patching guidance in the Oracle Security Alert Advisory and apply the corresponding Critical Patch Update to both 12.2.1.4.0 and 14.1.2.0.0 deployments.

Workarounds

Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP traffic from untrusted sources.
Disable IIOP on managed servers that do not require it via the WebLogic Server Administration Console.
Place WebCenter Enterprise Capture behind a reverse proxy or firewall that only permits required HTTP/HTTPS traffic from client networks.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Set in Admin Console: Domain > Security > Filter
# Format: target localAddress localPort action protocols

10.0.0.0/8    * * allow t3 t3s iiop iiops
0.0.0.0/0     * * deny  t3 t3s iiop iiops