Oracle disclosed a critical (CVSS 9.8) flaw in the Client Bundle component of Oracle WebCenter Enterprise Capture that lets an unauthenticated attacker with network access over T3 or IIOP fully take over the product.
What Is It
CVE-2026-60970 is a vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware, specifically the Client Bundle component. Oracle describes it as an "easily exploitable" issue that allows an unauthenticated attacker with network access via T3 or IIOP to compromise the affected product. Successful attacks result in takeover of Oracle WebCenter Enterprise Capture.
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges, and no user interaction required, with high confidentiality, integrity, and availability impact.
Why It Matters
The exploitability sub-score is the maximum 3.9: there is no authentication barrier and no victim interaction step between an attacker and full compromise. The listed attack surface is T3 and IIOP, the WebLogic remote protocols that Fusion Middleware deployments frequently expose internally and, in poorly segmented environments, externally. The stated outcome is not partial data disclosure but takeover of the product.
CVE-2026-60970 does not appear in CISA's Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), so active exploitation is not confirmed at this time. The catalog is updated continuously, and defenders should re-check it rather than treat the absence of an entry as durable. That is not a reason to defer patching a 9.8 with an unauthenticated network path.
What's Vulnerable
- Product: Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware)
- Component: Client Bundle
- Vendor: Oracle Corporation
- Affected supported versions: 12.2.1.4.0 and 14.1.2.0.0
No CPE entries were published alongside the record, and no other versions are listed as affected in the source data.
Patch Status
The CVE was published 2026-08-18 with an NVD status of "Received," meaning NVD enrichment is still pending. The record's only vendor reference points to an Oracle Critical Patch Update page, and that is where the fix and applicable patch guidance are published, but the supplied link should be treated with care on two counts.
First, the URL as recorded is malformed: Oracle's advisory path segment is cpu, not cspu, so the canonical form of a CPU page is https://www.oracle.com/security-alerts/cpu<mon><year>.html. Second, Oracle does not ship a Critical Patch Update in August. CPUs are released on a fixed quarterly cycle, January, April, July, and October, so no "August 2026 Critical Patch Update" exists. Defenders should confirm this CVE's fix against the July 2026 CPU and, if it is not listed there, the next quarterly release in October 2026. Oracle's security alerts index at https://www.oracle.com/security-alerts/ lists every published CPU and is the reliable starting point.
Until the correct advisory is confirmed, treat exposure reduction as the interim control: restrict T3 and IIOP reachability to trusted management networks and verify that no Fusion Middleware listener carrying those protocols is reachable from untrusted networks. No separate remediation instructions, workarounds, or required-action deadlines are present in the supplied source material.
Sources
- Oracle Critical Patch Update advisory reference as supplied in the CVE record (malformed path; see Patch Status), https://www.oracle.com/security-alerts/cspuaug2026.html
- Oracle Security Alerts index (authoritative CPU listing), https://www.oracle.com/security-alerts/
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- NVD, CVE-2026-60970, https://nvd.nist.gov/vuln/detail/CVE-2026-60970