CVE-2026-60456
A critical flaw in Oracle WebCenter Enterprise Capture lets attackers with network access take control of the application. The vulnerability can be exploited over HTTP by a low‑privileged user and can affect other Oracle products because the scope changes. It is rated CVSS 9.9.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0, used by enterprises running Oracle Fusion Middleware.
Real-world impact
An attacker could gain full control of the WebCenter Enterprise Capture installation, potentially accessing or modifying sensitive data and disrupting services. Because the flaw changes scope, other Oracle Fusion Middleware components might also be compromised.
Why this severity
The CVSS score of 9.9 reflects that the flaw is easy to exploit over the network, requires only low privileges, needs no user interaction, and gives the attacker complete confidentiality, integrity, and availability damage. The scope change also boosts the score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory