Oracle disclosed a CVSS 9.8 flaw in the Oracle WebCenter Enterprise Capture Client Bundle that may let an unauthenticated attacker reach the product over T3 or IIOP and take it over.
What Is It
CVE-2026-60921 is a vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. Oracle describes it as "easily exploitable"; an attacker with network access via the T3 or IIOP protocols can compromise the product without any credentials and without user interaction.
Successful exploitation can result in takeover of Oracle WebCenter Enterprise Capture.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That breaks down to:
- Attack vector: Network; reachable remotely
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High to confidentiality, integrity, and availability
The exploitability subscore is the maximum 3.9, with an impact subscore of 5.9. T3 and IIOP are WebLogic-family remoting protocols that are often exposed further than operators intend, which can make the "network access" precondition a low bar in practice.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time.
What's Vulnerable
Per Oracle, the affected supported versions of Oracle WebCenter Enterprise Capture are:
- 12.2.1.4.0
- 14.1.2.0.0
The vulnerable component is the Client Bundle. No CPE data was published in the NVD record at time of writing.
Patch Status
The CVE was published on 2026-08-18 by Oracle ([email protected]) and its NVD status is Received: meaning NVD analysis is not yet complete and details may change.
Fixes for Oracle Fusion Middleware issues are delivered through Oracle's quarterly Critical Patch Update, which ships only in January, April, July, and October. The most recent Critical Patch Update at time of writing is July 2026, which predates this disclosure and therefore does not address CVE-2026-60921. Administrators running 12.2.1.4.0 or 14.1.2.0.0 should plan for the next scheduled Critical Patch Update in October 2026, and watch for an out-of-cycle Oracle Security Alert in the interim. No specific required-action deadline was supplied in the source material.
Because the quarterly cadence can leave a gap of up to three months between disclosure and a published fix, restricting T3 and IIOP access to trusted management networks is the practical interim control.
Sources
- NVD, CVE-2026-60921: https://nvd.nist.gov/vuln/detail/CVE-2026-60921
- Oracle Critical Patch Update Advisory, July 2026: https://www.oracle.com/security-alerts/cpujul2026.html