A critical unauthenticated flaw in Oracle WebCenter Enterprise Capture's Client Bundle component lets a remote attacker fully take over the product over RMI, carrying a CVSS 3.1 base score of 9.8 as scored in the NVD record.
What Is It
CVE-2026-60947 is a vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. Successful attacks result in takeover of the product.
Per the NVD record, the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, and no user interaction, with high confidentiality, integrity, and availability impact. The same record lists an exploitability subscore of 3.9, the maximum, and an impact subscore of 5.9. Because the CVE is still in "Received" status, these values are as-submitted and have not yet been through NVD analyst review.
Why It Matters
The combination of no authentication, no user interaction, and low complexity means any RMI listener reachable by an attacker is a direct path to full product takeover. Because all three impact metrics are HIGH, a successful attack is not limited to data disclosure; it covers modification and denial of service as well.
CVE-2026-60947 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time. That does not lower the pre-conditions for attack, which remain minimal. Defenders should re-check the KEV catalog directly, since additions are made on a rolling basis.
What's Vulnerable
Oracle's advisory lists two affected supported versions of Oracle WebCenter Enterprise Capture:
- 12.2.1.4.0
- 14.1.2.0.0
The affected component is the Client Bundle, and the exposed attack surface is RMI network access. No CPE match data is present in the NVD record, so automated scanner coverage keyed on CPE may not flag affected hosts yet; confirm versions manually.
Patch Status
The CVE record was published 2026-08-18 with a vulnerability status of "Received," meaning NVD analysis is not yet complete. The referenced fix source is Oracle's Critical Patch Update advisory, which is the authoritative source for fix availability and version-specific patch guidance. Oracle publishes Critical Patch Updates on the quarterly schedule it announces in advance, January, April, July, and October, so administrators should consult the Oracle CPU advisory linked below to confirm whether a fix for this CVE has already shipped or is expected in an upcoming quarterly release. No specific remediation or required-action deadline is stated in the CVE record beyond the advisory reference.
Organizations running the affected versions should consult the Oracle CPU advisory and restrict network reachability of RMI endpoints in the interim.
Sources
- Oracle Critical Patch Update Advisory, July 2026, https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60947, https://nvd.nist.gov/vuln/detail/CVE-2026-60947
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog