What is the CVSS score of CVE-2026-60555?

CVE-2026-60555 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60555?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote compromise without authentication, requiring only standard HTTP network access-a critical threat to data…

How to fix or mitigate CVE-2026-60555?

Within 24 hours, immediately identify and inventory all instances of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 in production and non-production environments, then isolate affected systems by restricting HTTP network access to authorized users and trusted networks only. Within 7 days, escalate to Oracle support for patch timeline and potential temporary workarounds, implement enhanced monitoring and alerting on all WebCenter Sites instances for exploitation attempts, and evaluate Web Application Firewall rules to reduce attack surface. Within 30 days, prepare a full patch deployment and validation strategy with change control, and apply the vendor patch immediately upon release with mandatory production validation before returning systems to standard access levels.

Oracle WebCenter Sites CVE-2026-60555

EUVD-2026-46917 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w99x-5mh3-5qrh

Oracle Authentication Bypass Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated (PR:N), network HTTP (AV:N), easily exploitable (AC:L) attack yielding full takeover, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:40 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a top-priority patching item.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management (WEM) / content management platform bundled within Oracle Fusion Middleware, used to author, manage, and deliver large-scale customer-facing websites. The vulnerable component is identified simply as 'WebCenter Sites' itself, meaning the flaw sits in the core application/HTTP-facing layer rather than an optional add-on. Oracle did not assign a CWE (listed as N/A) and does not disclose root-cause details in its CPU advisories, so the specific weakness class (e.g., deserialization, authentication bypass, or injection) cannot be confirmed from the available data; the 'Information Disclosure' tag and the full C:H/I:H/A:H 'takeover' outcome suggest a high-privilege pre-authentication code or data access path. No CPE strings were provided, so affected configurations are derived from Oracle's named version list.

RemediationAI

Apply the patches from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 instances; Oracle CPU patches are cumulative, so applying the July 2026 CPU is the primary and authoritative fix. Oracle does not publish a discrete standalone fix version beyond the CPU bundle, so the exact patched build should be taken from the CPU patch set for your installed version. Until patching is complete, reduce exposure by restricting HTTP/HTTPS access to the WebCenter Sites application to trusted management networks or via a VPN, placing the application behind a WAF or reverse proxy with strict request filtering, and blocking direct internet access to administrative and content-delivery endpoints - noting that WAF rules are imperfect without root-cause detail and network restrictions may break legitimate public-site delivery, so these are stopgaps rather than substitutes for the CPU patch.