CVE-2026-60971: Oracle WebCenter Auth Bypass Vulnerability

CVE-2026-60971 Overview

CVE-2026-60971 is a critical vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically within the Client Bundle component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can exploit the vulnerability to fully compromise Oracle WebCenter Enterprise Capture. Successful exploitation results in complete takeover of the affected product, impacting confidentiality, integrity, and availability. The weakness maps to [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated remote attackers can take over Oracle WebCenter Enterprise Capture instances via T3 or IIOP network protocols.

Affected Products

Oracle WebCenter Enterprise Capture 12.2.1.4.0
Oracle WebCenter Enterprise Capture 14.1.2.0.0
Oracle Fusion Middleware (Client Bundle component)

Discovery Timeline

2026-08-18 - CVE-2026-60971 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60971

Vulnerability Analysis

The vulnerability resides in the Client Bundle component of Oracle WebCenter Enterprise Capture, a document capture platform within Oracle Fusion Middleware. Attackers reach the vulnerable code path through the T3 or IIOP remote invocation protocols exposed by the underlying WebLogic server. These protocols historically carry serialized Java objects between clients and servers.

Oracle classifies the issue as easily exploitable and does not require authentication, privileges, or user interaction. The scope remains unchanged, but the confidentiality, integrity, and availability impacts are all high, consistent with full product takeover. The attack surface is any network-reachable T3 or IIOP listener on an affected WebCenter Enterprise Capture deployment.

Root Cause

Oracle categorizes the weakness as improper access control [CWE-284]. The Client Bundle exposes functionality over T3 and IIOP without enforcing sufficient authentication or authorization checks. This design gap allows remote callers to invoke privileged operations that should be restricted to authenticated administrators.

Attack Vector

Exploitation requires only network access to the T3 or IIOP listener, typically ports 7001 or 7002 on WebLogic-based deployments. An attacker sends crafted protocol traffic that reaches vulnerable methods within the Client Bundle. No user interaction is required, and no credentials are needed. See the Oracle Security Alert for vendor-specific technical details.

No public proof-of-concept code is currently available. The EPSS probability is 0.358%.

Detection Methods for CVE-2026-60971

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listeners on ports 7001 or 7002 from untrusted networks.
New or unusual Java processes, child shells, or scripts spawned by the WebCenter Enterprise Capture managed server.
Modifications to WebCenter Capture configuration files, deployment descriptors, or credential stores outside change-management windows.
Outbound network connections initiated by the Capture JVM to external hosts.

Detection Strategies

Monitor WebLogic access and audit logs for anomalous T3 or IIOP method invocations against Capture components.
Correlate authentication events with T3 or IIOP traffic to identify unauthenticated access attempts.
Use behavioral analytics on the middleware host to flag process lineage anomalies, such as java.exe spawning command interpreters.

Monitoring Recommendations

Enable full audit logging on WebLogic and forward logs to a centralized SIEM for retention and correlation.
Alert on any external source addresses connecting to T3 or IIOP ports, which should be restricted to internal management networks.
Baseline normal Capture process behavior and file access patterns to detect deviations quickly.

How to Mitigate CVE-2026-60971

Immediate Actions Required

Apply the fixes published in the Oracle Critical Patch Update referenced in the Oracle Security Alert.
Inventory all WebCenter Enterprise Capture deployments running 12.2.1.4.0 and 14.1.2.0.0 and prioritize internet-exposed instances.
Restrict network access to T3 and IIOP listeners to trusted management hosts only.

Patch Information

Oracle addressed CVE-2026-60971 in the August 2026 Critical Patch Update. Administrators should download and apply the corresponding patches for WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 as directed in the Oracle Security Alert.

Workarounds

Block T3 and IIOP protocols at the network perimeter and internal firewalls where they are not required.
Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow only approved source addresses to reach T3 and IIOP ports.
Place WebCenter Enterprise Capture behind a reverse proxy that terminates only required HTTP or HTTPS traffic and does not forward T3 or IIOP.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# In WebLogic Admin Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.0.0.0/8 * * allow t3 t3s iiop iiops
192.168.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops