External risk intelligence

Oracle WebCenter Enterprise Capture RMI Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60947

The vulnerability affects a specific middleware component reachable via RMI (Remote Method Invocation). While network-accessible, Oracle WebCenter Enterprise Capture is typically deployed within internal enterprise network segments to manage document capture workflows, making public internet exposure of the RMI interface uncommon in standard configurations.

Oracle Webcenter Enterprise Capture

12.2.1.4.014.1.2.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebCenter Enterprise Capture, a component of Oracle Fusion Middleware. This issue, if exploited, could allow an unauthenticated attacker to gain complete control over the affected system, potentially impacting confidentiality, integrity, and availability. The main concern is confirming the relevance and exposure of this technology within our environment.

Unauthenticated attackers could seize control of Oracle systems.
Important to verify if we use this Oracle product.
Understand exposure to confirm relevance and potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests via RMI to the Oracle WebCenter Enterprise Capture client bundle. Successful exploitation allows the attacker to take over the entire Oracle WebCenter Enterprise Capture system.

Network access via RMI is required.
Attacker triggers the vulnerability remotely.
Full system takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via RMI could potentially take over the Oracle WebCenter Enterprise Capture system. This means an attacker could gain full control over the system's operations.

Oracle WebCenter Enterprise Capture system.
Network access via RMI.
Complete system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Oracle WebCenter Enterprise Capture requires immediate attention from application owners and potentially infrastructure or platform teams. The first step is to pinpoint all instances of this software, confirm their exposure and criticality, and identify the accountable business owner to prioritize remediation efforts.

Application owners must confirm all deployments.
Verify network reachability and business criticality.
Coordinate with Oracle for supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebCenter Enterprise Capture?

Oracle WebCenter Enterprise Capture is a software solution within the Oracle Fusion Middleware stack designed to streamline document capture and processing workflows. Organizations use it to digitize, organize, and manage large volumes of content from various sources, integrating these documents directly into enterprise content management systems to support automated business processes.

What does CVE-2026-60947 mean for system security?

This CVE describes a critical vulnerability that allows an unauthenticated, remote attacker to gain full control over the Oracle WebCenter Enterprise Capture software. Because the system is susceptible to unauthorized commands via a specific communication channel, an attacker could compromise the confidentiality, integrity, and availability of the entire application.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends specific network requests to the Client Bundle component using the Remote Method Invocation (RMI) protocol. Crucially, the system is only at risk if it is configured to accept these RMI requests from an untrusted network; internal processing that does not expose the RMI interface to external actors is not the intended vector for this exploit.

Is my environment at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is most concerning if your Oracle WebCenter Enterprise Capture instances are exposed to broad network access. While the RMI interface is reachable over a network, this product is typically deployed within protected internal segments to handle sensitive document workflows, making direct exposure to the public internet uncommon.

What steps should I take if I use this software?

Begin by auditing your environment to pinpoint all deployments of Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0. Once you have identified these instances, determine their network reachability and business criticality. Coordinate with your platform teams and the vendor to confirm the necessary updates to secure your specific installation.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.