This vulnerability affects Oracle WebCenter Enterprise Capture (component: Client Bundle) in versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers with network access via T3 and IIOP protocols, allowing full compromise of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation allows an unauthenticated attacker to take over Oracle WebCenter Enterprise Capture, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data compromise, and disruption of service. The critical severity and high CVSS score indicate a severe risk to affected environments if unpatched.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities. However, no explicit patch or remediation status for CVE-2026-60446 is provided in the advisory content. Customers should monitor Oracle's official security alerts for updates and apply relevant patches as they become available. Until a patch is confirmed, restricting network access to T3 and IIOP services and implementing network-level controls may help reduce exposure.