What is the CVSS score of CVE-2026-60552?

CVE-2026-60552 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60552?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability enabling complete system takeover by low-privileged network attackers.

How to fix or mitigate CVE-2026-60552?

Within 24 hours, inventory all systems running Oracle WebCenter Sites versions 12.2.1.4.0 or 14.1.2.0.0 and prepare patch deployment resources. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected systems; this is the sole vendor-released remediation for this vulnerability. Within 30 days, verify successful patch deployment across all instances, confirm no unpatched systems remain, and maintain enhanced monitoring for exploitation attempts.

Oracle WebCenter Sites CVE-2026-60552

EUVD-2026-46914 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vj7x-56x3-mq28

Oracle Authentication Bypass Webcenter Sites

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reachable and easily exploitable (AV:N/AC:L), requires a low-privileged account (PR:L), no user interaction, and full takeover with cross-product impact yields S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker sending HTTP requests over the network, with successful attacks resulting in complete takeover of the product. Oracle rates this CVSS 3.1 9.9 with a scope change, meaning the impact extends beyond WebCenter Sites into adjacent products. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and minimal privilege requirement make it a high patch priority; a fix was delivered in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience/content management platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic Server and Java EE and used to author and deliver marketing and web content at scale. The flaw resides in the core WebCenter Sites component and is reachable over HTTP by an authenticated but low-privileged user. Oracle did not assign a CWE (listed as N/A) and, per its Critical Patch Update convention, does not disclose the specific weakness class; the vendor tag 'Information Disclosure' plus the full C/I/A impact and scope change suggest a flaw that lets a low-privileged account cross a trust boundary to gain administrative control. The scope change (S:C in the CVSS vector) indicates the vulnerable component can affect resources beyond its own security authority, consistent with Oracle's note that attacks may significantly impact additional products.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) to the affected 12.2.1.4.0 and 14.1.2.0.0 installations; Oracle does not publish a separate point-release version string for CPU fixes, so identify the exact patch bundle for your release from the CPU matrix rather than an invented version number. Until patching completes, reduce exposure by restricting network reachability of the WebCenter Sites HTTP interfaces to trusted networks or VPN, tightening or auditing low-privilege application accounts (since PR:L access is the exploitation prerequisite), and placing a WAF/reverse proxy in front of the application to log and constrain requests - noting these are compensating controls only, do not address the root cause, and may break legitimate remote content-management workflows or integrations. Because of the scope change, also monitor adjacent Fusion Middleware and WebLogic components for anomalous activity after any suspected compromise.