What is the CVSS score of CVE-2026-60551?

CVE-2026-60551 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60551?

Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical remote code execution vulnerability (CVSS 9.8) allowing unauthenticated attackers to achieve complete system compromise…

How to fix or mitigate CVE-2026-60551?

Within 24 hours: inventory all systems running Oracle WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0, classify by business criticality, and verify network exposure. Within 7 days: implement network segmentation to restrict access to affected systems, deploy WAF rules to limit HTTP exposure, enable enhanced logging on WebCenter Sites instances, and contact Oracle support for interim guidance. Within 30 days: develop and execute a remediation timeline to upgrade to a patched version (when released by Oracle) or decommission affected systems; establish executive sponsorship given the critical risk window.

Oracle WebCenter Sites CVE-2026-60551

EUVD-2026-46913 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-w449-389p-4j4f

Authentication Bypass Oracle Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated, easily exploitable HTTP-reachable takeover with full CIA loss, giving AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:42 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, resulting in complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Oracle rates the flaw 'easily exploitable' and disclosed it in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience/content management platform bundled within the Oracle Fusion Middleware stack, typically deployed on WebLogic Server and exposed over HTTP(S) to serve customer-facing web content. The vulnerability resides in the core 'WebCenter Sites' component itself and is reachable directly via the HTTP interface without authentication, which is characteristic of a pre-auth flaw in a request-handling or deserialization/injection path. Oracle assigned CWE 'N/A' and tagged the issue 'Information Disclosure,' but the CVSS vector (C:H/I:H/A:H) and Oracle's own 'takeover' language indicate impact far beyond disclosure - the root cause class cannot be confirmed from the sparse advisory data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs deliver cumulative patches per product line for the affected 12.2.1.4.0 and 14.1.2.0.0 releases, and the exact patched build should be taken directly from the CPU patch matrix as no discrete fix version was included in this feed. Because exploitation is unauthenticated over HTTP, until patching is complete restrict network exposure of the WebCenter Sites HTTP interface - place it behind a VPN or IP allowlist, terminate public access at a reverse proxy/WAF and filter anomalous requests to the affected component, and remove the management/content endpoints from direct internet reachability. These network controls reduce reachability but do not remediate the underlying flaw and may break legitimate remote content contributors or public site delivery, so treat them strictly as interim measures pending patch deployment.