What is the CVSS score of CVE-2026-60558?

CVE-2026-60558 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-60558?

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVSS 8.1) enabling unauthenticated remote attackers to achieve complete system takeover via HTTP, with full…

How to fix or mitigate CVE-2026-60558?

Within 24 hours, execute an asset inventory to identify all systems running WebCenter Sites 12.2.1.4.0 or 14.1.2.0.0 and evaluate network exposure from untrusted sources. Within 7 days, deploy interim protective controls including network segmentation to restrict HTTP/HTTPS access to affected systems, Web Application Firewall rules to inspect HTTP traffic for exploitation patterns, and comprehensive request logging with alerting for suspicious activity. Within 30 days, apply the July 2026 Critical Patch Update from Oracle when released; coordinate testing and deployment to eliminate the vulnerability once the patch becomes available.

Oracle WebCenter Sites CVE-2026-60558

EUVD-2026-46920 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-cgfr-rhrw-wmrp

Authentication Bypass Oracle Webcenter Sites

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable takeover justifies AV:N/PR:N and full C/I/A:H; Oracle's 'difficult to exploit' precondition supports AC:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:39 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle WebCenter Sites (Fusion Middleware) is possible over the network by an unauthenticated attacker via HTTP, resulting in complete product takeover with high confidentiality, integrity, and availability impact. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle addresses it in the July 2026 Critical Patch Update. The high attack complexity (AC:H) tempers real-world risk, and there is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Oracle WebCenter Sites is an enterprise web experience management (WEM) and content management platform within the Oracle Fusion Middleware stack, used to author, manage, and deliver public-facing websites and digital content. The vulnerability resides in the core 'WebCenter Sites' component and is reachable over HTTP, meaning the exposed web-tier application (typically deployed on WebLogic Server) is the attack surface. No CWE was assigned in the source data, so the precise root-cause class (e.g., deserialization, authentication bypass, or injection) cannot be confirmed from the available intelligence; Oracle's tag of 'Information Disclosure' is narrower than the CVSS profile, which indicates full C/I/A takeover rather than mere disclosure.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update (Vendor-released patch per Oracle CPU July 2026) for the affected 12.2.1.4.0 and 14.1.2.0.0 branches; the advisory and patch matrix are at https://www.oracle.com/security-alerts/cpujul2026.html - an exact fixed build number was not included in the source data, so consult the CPU matrix for the specific patch/bundle ID for your version. Until patching is complete, reduce exposure by restricting network access to the WebCenter Sites HTTP endpoints so they are not reachable from the internet or untrusted networks (place behind a VPN or IP allowlist), and front the application with a WAF to inspect and filter anomalous HTTP requests; the trade-off is that overly aggressive filtering or access restriction can break legitimate content-author and delivery traffic, and neither control fully substitutes for the vendor patch given the unauthenticated network vector.