Oracle has disclosed CVE-2026-60958, a critical unauthenticated remote takeover of Oracle WebCenter Enterprise Capture reachable over plain HTTP. The advisory text points to a fix delivered through Oracle's Critical Patch Update process, but the specific CPU release carrying it could not be confirmed against Oracle's published advisory index at time of writing.
What Is It
CVE-2026-60958 is a vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically in the Client Bundle component. Per Oracle's advisory text, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful attacks result in full takeover of Oracle WebCenter Enterprise Capture.
It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability. The exploitability sub-score is the maximum 3.9.
Why It Matters
The combination here is the worst-case set: no credentials, no user interaction, low attack complexity, and a takeover outcome. Any WebCenter Enterprise Capture instance with an HTTP listener exposed to an attacker-controlled network is directly at risk.
The NVD record lists [email protected] as the assigning CNA, that is Oracle's standard CNA contact for records it assigns and publishes, and it identifies the source of the record rather than the party who discovered or reported the flaw. The NVD entry does not name a reporter or researcher credit. The fix ships through the Critical Patch Update process, which does not mean a public patch diff exists: Oracle Fusion Middleware patches are distributed as binaries through My Oracle Support to licensed customers, and Oracle does not publish source-level diffs or detailed root-cause writeups alongside a CPU. What the advisory does hand an attacker is component-level targeting, the affected product, the specific bundle, the version range, and the fact that the path is pre-auth over HTTP, which is usually enough to narrow reverse-engineering effort considerably once patched binaries circulate.
Capture handles document ingestion pipelines, so a takeover puts both the application and the content flowing through it in the attacker's hands.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the material available at time of writing. That is not a reason to defer patching given the exploitability profile.
What's Vulnerable
Oracle Corporation; Oracle WebCenter Enterprise Capture, supported versions:
- 12.2.1.4.0
- 14.1.2.0.0
No affected CPE list was published in the NVD record at time of writing.
Patch Status
The fix is delivered through an Oracle Critical Patch Update, though which CPU release contains it is not established by the available material. Oracle ships CPUs on a fixed quarterly cadence, January, April, July, and October, so there is no August 2026 Critical Patch Update; the applicable release is most likely the July 2026 CPU, or the next scheduled CPU in October 2026 if the fix landed after the July cycle. The NVD record for this CVE was published 2026-08-18, which reflects NVD ingestion timing rather than a separate Oracle advisory date.
Because the exact CPU release for this CVE could not be confirmed against Oracle's published advisory index, operators should locate CVE-2026-60958 in the risk matrix of the relevant CPU advisory on Oracle's security alerts page before assuming a given patch level is sufficient, then apply the CPU-supplied patch for the affected version. In the interim, restrict network reachability of Capture HTTP listeners to trusted segments.
The NVD record remains in Received status; enrichment, including CWE mapping and CPE data, is still pending.
Sources
- NVD, CVE-2026-60958: https://nvd.nist.gov/vuln/detail/CVE-2026-60958
- Oracle Security Alerts index (authoritative list of Critical Patch Update advisories, and the correct starting point for locating the CPU that carries this fix): https://www.oracle.com/security-alerts/
- Not a source; do not use: https://www.oracle.com/security-alerts/cspuaug2026.html was constructed by pattern-matching Oracle's advisory URL format for an August 2026 CPU. No such CPU exists, and this URL does not resolve to an Oracle advisory. It is retained here only to flag it as invalid.