What is the CVSS score of CVE-2026-60557?

CVE-2026-60557 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle WebCenter Sites CVE-2026-60557

EUVD-2026-46919 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-jpg5-57m5-vgc4

Authentication Bypass Oracle Webcenter Sites

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network vector and no privileges required confirmed by description; UI:R mandatory per advisory; pure confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:08 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

Oracle WebCenter Sites is an enterprise-grade web content management system (CMS) shipped as part of the Oracle Fusion Middleware stack. It serves as a digital experience platform used by large enterprises for web content authoring, publishing, and delivery over HTTP/HTTPS. The affected CPE targets specifically versions 12.2.1.4.0 (a long-term support release) and 14.1.2.0.0 (the current major release), both of which are in Oracle's supported lifecycle. The CWE identifier was not provided by Oracle, which is characteristic of Oracle CPU advisories that deliberately omit root-cause classification. Based on the 'Authentication Bypass' tag and the CVSS metrics (PR:N, UI:R, C:H, I:N, A:N), the root cause class most consistent with the data is an unauthenticated information disclosure pathway - likely a reflected or server-side request-forgery pattern - where attacker-supplied input processed during a user's HTTP session circumvents access controls and returns sensitive CMS data. The absence of CWE disclosure is a known gap in Oracle's public advisory practice.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for all affected products; the exact patched build version for WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 must be confirmed from the CPU patch availability matrix on the Oracle support portal (My Oracle Support). No specific workaround is described in the available advisory data. Until the patch is applied, compensating controls should include restricting HTTP access to WebCenter Sites administrative and content delivery endpoints to known IP ranges via network ACLs or a WAF, and auditing WebCenter Sites access logs for anomalous unauthenticated or cross-origin request patterns. Disabling any externally exposed preview or anonymous content endpoints, if not operationally required, will reduce the exploitable attack surface. Note that network-layer restrictions may impact legitimate content delivery if WebCenter Sites serves public-facing web content.