What is the CVSS score of CVE-2026-60554?

CVE-2026-60554 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60554?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are affected by an authentication bypass vulnerability (CVE-2026-60554, CVSS 7.5 HIGH) enabling unauthenticated remote attackers to access…

How to fix or mitigate CVE-2026-60554?

Within 24 hours: Identify and document all Oracle WebCenter Sites deployments running versions 12.2.1.4.0 or 14.1.2.0.0, including their network exposure and data sensitivity classification. Within 7 days: Deploy the July 2026 Critical Patch Update to all affected systems with priority given to production and data-sensitive instances; verify patch installation and validate application functionality post-deployment. Within 30 days: Analyze access logs for the vulnerability exposure window to identify any unauthorized or anomalous data access attempts; conduct comprehensive security review of WebCenter Sites configurations and access controls.

Oracle WebCenter Sites CVE-2026-60554

EUVD-2026-46916 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-hqfw-2h2m-3qc8

Authentication Bypass Oracle Information Disclosure Webcenter Sites

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) yielding high confidentiality data disclosure but no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote attacker with only HTTP network access to read critical data and potentially all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 with pure confidentiality impact; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Oracle addressed the issue in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management (WEM) and content management platform within the Oracle Fusion Middleware stack, typically deployed on WebLogic Server and used to author, manage, and deliver large-scale marketing and corporate websites. The vulnerability lives in the core WebCenter Sites component and is characterized in the multi-source tags as an authentication bypass, meaning an attacker can reach and retrieve protected data without presenting valid credentials. No CWE was assigned in the source data, but the CVSS profile (network vector, no privileges, confidentiality-only impact) is consistent with a broken/missing access-control or improper-authentication weakness class (e.g., CWE-287/CWE-306/CWE-639) rather than a memory-safety or code-execution flaw.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle CPUs deliver bundle patches rather than a single named product version, so confirm the exact patch level for your 12.2.1.4.0 or 14.1.2.0.0 installation against the CPU patch matrix. Because Oracle discloses minimal technical detail, prioritize patching over workarounds; where immediate patching is not possible, reduce exposure by restricting network access to the WebCenter Sites application (place it behind a VPN or internal-only segment), enforcing a WAF or reverse-proxy access-control layer in front of the affected HTTP endpoints, and limiting who can reach the management and delivery interfaces from the internet. These network-restriction controls trade off external accessibility of the site delivery/management tiers and may break legitimate public or partner access, so validate against your deployment topology, and note that any compensating control is inferior to the vendor patch given the unauthenticated network vector.