What is the CVSS score of CVE-2026-60561?

CVE-2026-60561 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60561?

Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical account takeover vulnerability (CVSS 9.9) allowing authenticated attackers with low-level portal access to achieve…

How to fix or mitigate CVE-2026-60561?

Within 24 hours, conduct immediate inventory of all Oracle WebCenter Portal deployments to identify affected versions 12.2.1.4.0 and 14.1.2.0.0, and assess network exposure and business criticality. Within 7 days, implement compensating controls including network segmentation to restrict portal access to trusted internal networks only, deploy Web Application Firewall (WAF) rules to detect and block exploitation patterns, minimize unnecessary low-privilege user accounts and permissions, enforce multi-factor authentication for sensitive portal operations, and establish real-time logging and alerting for suspicious authentication activity. Within 30 days, establish direct contact with Oracle support for patch timeline confirmation, evaluate migration paths to unaffected Oracle WebCenter versions, and develop contingency plans including alternate portal solutions if patch availability extends beyond 90 days.

Oracle WebCenter Portal CVE-2026-60561

EUVD-2026-46923 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-67h9-rjwf-wjvc

Oracle Webcenter Portal Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Reachable over HTTP with low complexity and no user interaction, but requires a low-privilege portal account (PR:L); scope change and full takeover justify S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:38 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account/instance takeover in Oracle WebCenter Portal (Fusion Middleware component: Runtime Tools) lets a low-privileged remote attacker fully compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can spill beyond the portal into other Fusion Middleware components, and Oracle rates full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.9). No public exploit has been identified at time of analysis, but the low attack complexity and 'easily exploitable' vendor wording make this a high-priority patch item.

Technical ContextAI

Oracle WebCenter Portal is an enterprise portal/user-engagement platform built on Oracle Fusion Middleware (typically running atop WebLogic Server and the Oracle HTTP stack). The affected component, 'Runtime Tools,' handles portal runtime administration and management functions exposed over HTTP. Oracle publishes no CWE for this entry (CWE: N/A), so the precise root-cause class is not disclosed; the vendor's own tag ('Information Disclosure') plus the full C:H/I:H/A:H impact and scope change suggest an access-control or authorization weakness in a runtime endpoint that permits an authenticated-but-low-privileged user to escalate to a full portal takeover. The scope change (S:C) indicates the vulnerable component can act on resources beyond its own security authority - consistent with the shared WebLogic/Fusion Middleware runtime where one compromised component can affect co-located services.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 - Oracle CPU patches are cumulative and no standalone fix version was published in the input, so install the CPU-provided patch/bundle for your version. As compensating controls until patched, restrict network reach to the WebCenter Portal Runtime Tools endpoints by placing them behind a reverse proxy or WAF and allow-listing only trusted administrative networks (trade-off: may break legitimate remote admin access), and tighten account provisioning so few users hold even low-privilege portal roles since PR:L is the exploitation prerequisite (trade-off: added user-management overhead). Because the flaw is exploitable by any low-privileged authenticated user, also audit existing portal accounts for unexpected or dormant low-privilege users and enforce strong session/authentication controls on the HTTP entry point.