What is the CVSS score of CVE-2026-60562?

CVE-2026-60562 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebCenter Portal are affected by CVE-2026-60562?

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVE-2026-60562, CVSS 9.9) allowing any authenticated portal user to gain administrative privileges and…

How to fix or mitigate CVE-2026-60562?

Within 24 hours: Identify all Oracle WebCenter Portal instances running versions 12.2.1.4.0 or 14.1.2.0.0 and document connectivity to other Fusion Middleware components. Within 7 days: Implement network-level access restrictions to WebCenter Portal, enforce multi-factor authentication for all portal accounts, and apply any interim mitigations published by Oracle. Within 30 days: Escalate with Oracle Support for patch timeline and feasibility of upgrading to patched versions.

Oracle WebCenter Portal CVE-2026-60562

EUVD-2026-46924 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5545-f2x4-2cmv

Authentication Bypass Oracle Webcenter Portal

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Remote HTTP exploitation with low complexity and a low-privileged account (PR:L), no user interaction, and a scope-changing full C/I/A takeover, matching Oracle's assessment.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:37 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-escalating account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Runtime Tools component) lets a low-privileged, network-authenticated attacker fully compromise the portal over HTTP and, because of a scope change (S:C), pivot into other components of the Oracle Fusion Middleware stack. Oracle rates it CVSS 9.9 with full confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.

Technical ContextAI

Oracle WebCenter Portal is a Java/Oracle Fusion Middleware (WebLogic-based) enterprise portal platform for building intranets, extranets, and composite web applications. The flaw resides in the 'Runtime Tools' component, which handles runtime administration and content/tooling operations exposed over HTTP. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail in its Critical Patch Update advisories, so the specific weakness class (e.g., access-control bypass, injection, or deserialization) is not confirmed; the vendor-supplied tag 'Information Disclosure' and the full C/I/A impact suggest an authorization or injection weakness that escalates a low-privileged session to full control. The CVSS scope change (S:C) indicates the vulnerable WebCenter component can affect resources managed by a different security authority - typical when a portal running on WebLogic can reach the underlying application server or connected middleware.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; the patch is available per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory - Oracle CPUs ship as cumulative bundle/quarterly patches rather than a single named point release, and no exact fixed build string was provided in the input, so consult the CPU patch matrix for the correct patch for 12.2.1.4.0 and 14.1.2.0.0). Prioritize patching internet-facing WebCenter Portal instances first. Until patching completes, reduce exposure by restricting network access to the WebCenter Portal HTTP endpoints and the Runtime Tools functionality to trusted administrative networks (via WAF/reverse-proxy or firewall rules), tightening account provisioning so few low-privileged users exist, and reviewing WebLogic/portal roles to minimize authenticated attack surface; note that URL/endpoint restrictions may break legitimate remote administration and portal tooling workflows, so validate against business use before enforcing. There is no confirmed vendor-supported workaround that fully mitigates the flaw short of the patch.