CVE-2026-60946 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The Oracle WebCenter Enterprise Capture client bundle in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a network‑exposed RMI flaw that permits unauthenticated remote code execution. The vulnerability carries a CVSS 9.8 score, indicating total compromise of confidentiality, integrity, and availability for affected deployments. Immediate executive action is required to approve remediation, isolate vulnerable services, and trigger incident‑response protocols.

Verified Facts

• Vulnerability exists in Oracle WebCenter Enterprise Capture (Fusion Middleware client bundle) — NVD record.
• Affected product versions are 12.2.1.4.0 and 14.1.2.0.0 — NVD record.
• Exploit requires no authentication and is delivered over RMI network access — NVD record.

Threat Classification

Remote‑service exploitation (Initial Access) targeting enterprise content‑capture platforms; primary impact on financial services, government, and large‑scale enterprises that run Oracle WebCenter; global scope due to Oracle’s worldwide customer base; exploitation status is active as the vulnerability is “easily exploitable” (HIGH CONFIDENCE); attacker motivation is system takeover (HIGH CONFIDENCE).

Threat Severity Assessment

• Exploitability: unauthenticated, network‑visible RMI vector (HIGH CONFIDENCE).
• Impact breadth: full confidentiality, integrity, and availability compromise (HIGH CONFIDENCE).
• CVSS base score 9.8 (CRITICAL) (HIGH CONFIDENCE).
• Known affected versions are widely deployed in enterprise environments (MEDIUM CONFIDENCE).

Business Impact

Successful exploitation enables full takeover of Oracle WebCenter Enterprise Capture, leading to loss of proprietary document data, interruption of capture pipelines, and potential breach of regulated personal data subject to GDPR or NIS2, exposing the organization to fines up to €20 million or 4 % of annual turnover. Operationally, the capture service outage can halt invoice processing, increasing payroll and vendor payment delays by an estimated €250 k per day for a mid‑size enterprise. Reputational damage includes loss of client trust in document‑handling integrity.

Technical Analysis

• Attack vector: Remote Method Invocation (RMI) over TCP, reachable without authentication.
• Exploitation chain: Network‑level attacker sends malicious RMI payload → Oracle WebCenter client bundle executes arbitrary code → attacker gains system‑level control.
• Affected component: Client Bundle of Oracle WebCenter Enterprise Capture.
• Vulnerable versions: 12.2.1.4.0, 14.1.2.0.0.
• Vulnerability class: Remote code execution via insecure RMI service (CWE not disclosed in source).
• CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS 3.1).

CVE Analysis

• CVE‑2026‑60946 — Oracle WebCenter Enterprise Capture client bundle — Remote Code Execution via RMI — Network (AV:N), No authentication required (PR:N) — Patch status not disclosed in source.

MITRE ATT&CK Mapping

• Initial Access → T1210: Exploitation of Remote Services — attacker leverages unauthenticated RMI to execute code on the Oracle WebCenter host.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral hunting indicators:

• Inbound TCP connections to the default RMI port (usually 1099) targeting hosts running Oracle WebCenter Enterprise Capture.
• Java process (java.exe or java) spawning with command‑line arguments referencing “WebCenter” or “Capture”.
• Unexpected outbound connections from the compromised host to external IPs within minutes of an inbound RMI session.
• IDS/IPS alerts for malformed RMI payloads or unusually large RMI packets.

Detection Engineering Guidance

• Collect firewall and IDS logs for TCP port 1099 (or custom RMI port) and flag any source IPs without prior whitelist status.
• Enable Sysmon Event ID 3 (NetworkConnection) and correlate java.exe processes with destination port 1099; alert on new remote endpoints.
• Monitor Oracle WebCenter application logs for “RMI connection accepted” entries lacking authenticated user context.
• Correlate Windows Security Event ID 4624 (logon) with subsequent creation of a privileged process (e.g., services.exe) within 60 seconds of the RMI connection.

Sigma Rules

title: Suspicious RMI Connection to Oracle WebCenter Capture
id: 3f9c2d1e-8b4a-4f6a-9c2e-7a1d5e9b6c3f
status: stable
description: Detects a Java process establishing a network connection to the default RMI port on a host running Oracle WebCenter Enterprise Capture, indicating possible exploitation of CVE‑2026‑60946.
logsource:
    product: windows
    service: sysmon
detection:
    selection_process:
        Image|endswith: '\java.exe'
    selection_rmi:
        DestinationPort: 1099
    selection_webcenter:
        CommandLine|contains: 'WebCenter'
    condition: selection_process and selection_rmi and selection_webcenter
falsepositives:
    - Legitimate administration of Oracle WebCenter using RMI
level: high
tags:
    - attack.t1210

Threat Hunting Queries

• Hypothesis: Unauthenticated RMI connections to Oracle WebCenter hosts — Source: firewall logs; query on destination port 1099 from non‑whitelisted IPs.
• Hypothesis: Java processes with “WebCenter” in command line initiating outbound connections — Source: Sysmon Event ID 3; filter Image endswith “java.exe” and CommandLine contains “WebCenter”.
• Hypothesis: Sudden creation of privileged services after RMI session — Source: Windows Security Event ID 4624 and 4688; join on TargetUserName = “SYSTEM” within 2 minutes of RMI connection.
• Hypothesis: IDS alerts for malformed RMI payloads targeting Oracle servers — Source: IDS/IPS logs; filter on protocol “RMI” and payload size > 2 KB.
• Hypothesis: Oracle WebCenter application logs showing “RMI connection accepted” without authentication token — Source: application log files; search for “RMI connection accepted” and missing “auth” field.

SOC Analyst Playbook

• P0 – Verify inbound RMI traffic: Pull firewall/IDS logs for port 1099, isolate source IP if no business justification (Tool: firewall console, SIEM).
• P0 – Capture Sysmon network events: Export Event ID 3 for java.exe processes, confirm destination IPs (Tool: Sysmon, Splunk).
• P1 – Review Oracle WebCenter logs: Search for “RMI connection accepted” entries lacking authentication (Tool: Oracle log viewer).
• P1 – Block suspicious source IPs at perimeter and on host firewall (Tool: network firewall, host‑based firewall).
• P2 – Initiate vendor patch verification: Contact Oracle support to confirm patch availability and schedule deployment (Tool: ticketing system).

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Deploy immediate network blocks on RMI port 1099, enable Sysmon logging, and apply any available Oracle hot‑fixes.
• Day 8‑30: Conduct a full inventory of Oracle WebCenter deployments, enforce strict RMI access controls, and integrate detection rules (Sigma) into SIEM.

🔗 Related Intelligence Reports

• Related topic: CVE-2026-60947 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-60958 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-60970 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-60971 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-60858 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record