What is the CVSS score of CVE-2026-60553?

CVE-2026-60553 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60553?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical authentication bypass vulnerability (CVE-2026-60553, CVSS 8.7) allowing unauthenticated remote attackers to read, create,…

How to fix or mitigate CVE-2026-60553?

Within 24 hours, identify all instances of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 in your environment and audit network access to these systems. Within 7 days, implement immediate compensating controls by restricting HTTP access to trusted networks, deploying WAF rules to detect authentication bypass patterns, and enforcing database-level access restrictions; simultaneously, begin testing upgrades to Oracle WebCenter Sites 14.1.2 with latest patches or newer supported versions. Within 30 days, complete migration to a patched version once vendor patches are released, and conduct forensic analysis of access logs to identify any unauthorized data access or modification.

Oracle WebCenter Sites CVE-2026-60553

EUVD-2026-46915 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-84x9-8j9v-qmw6

Authentication Bypass Oracle Webcenter Sites

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network-reachable unauthenticated HTTP attack (AV:N/PR:N/UI:N) with a non-trivial precondition (AC:H) and scope change; high confidentiality/integrity impact, no availability effect, matching the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read, create, delete, or modify all data accessible to the product over HTTP, with a scope change that can significantly impact adjacent products. Oracle rates this CVSS 8.7 with high confidentiality and integrity impact but high attack complexity, and the vendor tags it as an authentication bypass. No public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management (WEM) and content management platform bundled within Oracle Fusion Middleware, typically deployed as a Java/WebLogic application serving public-facing and editorial web content. The advisory does not assign a CWE, but the 'Authentication Bypass' tag combined with PR:N (no privileges required) indicates the flaw allows an attacker to reach privileged content-management operations without valid credentials. The scope change (S:C) in the CVSS vector means the vulnerable WebCenter Sites component can be leveraged to affect resources beyond its own security authority - plausibly the underlying WebLogic container, shared datastores, or federated content delivery systems.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for both affected releases; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle and post-install steps for your version. The input does not name an individual fixed build number, so treat 'Patch available per vendor advisory' as the patch status and pull the precise patch ID for 12.2.1.4.0 or 14.1.2.0.0 from the CPU matrix rather than assuming a version string. Until patched, restrict network access to the WebCenter Sites HTTP interface - place it behind a VPN or IP allowlist and block direct internet exposure of the admin/content-management endpoints, accepting that this may disrupt remote editorial workflows; add WAF rules in front of the application and monitor for anomalous unauthenticated content-creation or modification requests as a detective control, recognizing WAF signatures for a novel bypass may be incomplete.