CVE-2026-60524 is a vulnerability in Oracle WebCenter Enterprise Capture (component: Client Bundle) that allows a low privileged attacker with network access via T3 or IIOP to compromise the product. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. Successful exploitation can result in full takeover of Oracle WebCenter Enterprise Capture, with impacts on confidentiality, integrity, and availability (CVSS 3.1 score 9.9). The vulnerability also has scope change implications, potentially impacting other Oracle products. Oracle has published a Critical Patch Update advisory for July 2026 but does not explicitly confirm a patch for this vulnerability in the provided advisory content. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebCenter Enterprise Capture, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via T3 or IIOP protocols. The vulnerability's scope change indicates potential impact on additional Oracle products beyond WebCenter Enterprise Capture.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends that customers remain on actively-supported versions and apply security patches without delay once available. Until a patch is confirmed and applied, restrict network access to T3 and IIOP services where possible to reduce exposure.